MSExchangeTransport Event ID 3018 error

I recently increased SMTP logging (and other logging) to try to find the source of frequent login errors. Some of them are caused by people trying to use my server to relay spam, and  those errors specify a relay failure and a source IP address.

I notice another type of error that I get a few times a day:

MSExchangeTransport Event ID 3018

A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;gary@internatiionalauthors.com (Message-ID <D814D4924F7341499C0276BCC31F5D14@dasilva.local>). Causes: This message indicates a DNS problem or an IP address configuration problem Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format. For more information, click http://www.microsoft.com/contentredirect.asp.

My server's domain is DASILVA.LOCAL. My public domain name is www.internationalauthors.com. Many of these MSExchangeTransport errors have the same misspelling of my public domain name with an extra letter "i": "internatiionalauthors". I cannot tell from the Event log whether someone from the outside keeps trying to access my server with the misspelled domain name (which doesn't bother me so much) , or if I myself mistyped it in one of my configration files (which does bother me). I don't know where to start looking.

Can anyone suggest where to find the answer? I already checked my HOSTS file, which only has only  one line: 127.0.0.1 localhost.

Many thanks.
ClapadorAsked:
Who is Participating?
 
RadweldCommented:
You can use the message tracking service to find the ndr and the original message but it can't be coming from external otherwise you would need mx records for the mis spelled domain.

Start by examining the users effected to see if they have the mis spelled address listed as a emal address (remember to use exchange active directory users and computers)

Dot think its a recipient policy as this would stamp that address to all your users but check anyway.

Message tracking logs. Find the sender then your in a better position to know.
0
 
ClapadorAuthor Commented:
Radweld knew what  the likely cause was and explained what to look for. The only hard part (for me) was figuring out where the logs were and how to search them, since I had never done this before.
0
 
ClapadorAuthor Commented:
The culprit was a typo that I made when entering my own e-mail address in Symantec Mail Security for Exchange for it to send me notification of errors. Radweld was correct when he said the  message originated internally,
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.