Exchange 2007 same email over and over

Apexadmin
Apexadmin used Ask the Experts™
on
I have a user that is getting this one email over and over every 5-10 minutes. It is Exchange 2007 on a 2008 SBS server. No other user is having this issue. We have a spam filter device in the cloud that filters the mail, the mail is duplicating through it. I look at the Exchange Message tracking. It shows the email over and over to the user and the messageID is the same. Thoughts?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Cris HannaSr IT Support Engineer

Commented:
I'm guessing that you are using the POP3 connector and someone was BCC'd in this email?

Commented:
When you track the message, what are the events that you see?
Do you see a Receive SMTP over and over again? if yes, what is the client IP? what is it pointing to?

Have you disabled Store duplicate detection? Check the keys mentioned in
http://technet.microsoft.com/en-us/library/dd577073(EXCHG.80).aspx

Is this happening to only one user? what is the message type that he is getting? IPM.NOTE?

Author

Commented:
The EventID is RECEIVE, Source is SMTP. It is over and over again. The Client IP is the cloud spam filter, where it was sent from, days prior.

I have not disabled Store duplicate detection.

Yes, only one user. I am not sure of the message type.

Weird thing is, I think it has stopped. The logs don't show anymore. Waiting for the user to get in to confirm.
Expert Spotlight: Joe Anderson (DatabaseMX)

We’ve posted a new Expert Spotlight!  Joe Anderson (DatabaseMX) has been on Experts Exchange since 2006. Learn more about this database architect, guitar aficionado, and Microsoft MVP.

Commented:
If you are seeing multiple SMTP receive events that means that the mails are coming in from the cloud spam filter over and over again. Recommended to check with the Cloud spam filter team on why they are submitting it so many times

Author

Commented:
We manage and monitor the spam filter device. There are no logs of this email sending multiple emails and it logs everything. Also wouldn't each email have a different Mail ID on the Exchange server if it was being sent from an outside source over and over?

Commented:
That is correct. The reason why I was talking about Multiple emails coming in was because when the Message tracking shows that multiple SMTP receives, then it usually means that the message is received on the server multiple times.

Ideally message Id should have been different for different emails received by the Exchange from internet provided the Message Id is not stamped on the message previously before reaching the Exchange server. what is the message ID field in the message tracking show? does it show the same message ID every time?

Author

Commented:
It is the same message ID every time.

Commented:
If the message is being stamped by the sending server, the Exchange will not take the pains to stamp the message ID again.

What is the Message ID? does it have your server name in it? if the Exchange is stamping with a message ID, then the message ID will have something like this

eg:

Message-ID: <B6E704C90D73D449BFB7F58C5C1F615405116D@Server FQDN here>

See the server FQDN part. Is it your server's FQDN?
Above is just a sample message ID.
The part before @ can be any random string but after that will be your server's FQDN if it is stamped by the Exchange server.

Author

Commented:
This is the message ID for all of them. The same exact.

<73889c8c-e1a5-4346-95ce-0c5827fb9a9d@blur>

I have no idea what that domain but that is not customers domain nor is it the senders.
Commented:
If it is not your server name in the message id field, then usually it is not your server which is doing it.

If you had enabled logging on the receive connector which receives emails from internet, you would have known for sure if it was being submitted multiple times to the server.

Author

Commented:
The issue stopped before I could further isolate it. All your troubleshooting steps were very helpful. Thanks.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial