MSExchangeTransport Event ID 3018 error

I recently increased SMTP logging (and other logging) to try to find the source of frequent login errors. Some of them are caused by people trying to use my server to relay spam, and  those errors specify a relay failure and a source IP address.

I notice another type of error that I get a few times a day:

MSExchangeTransport Event ID 3018

A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822; (Message-ID <D814D4924F7341499C0276BCC31F5D14@dasilva.local>). Causes: This message indicates a DNS problem or an IP address configuration problem Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format. For more information, click

My server's domain is DASILVA.LOCAL. My public domain name is Many of these MSExchangeTransport errors have the same misspelling of my public domain name with an extra letter "i": "internatiionalauthors". I cannot tell from the Event log whether someone from the outside keeps trying to access my server with the misspelled domain name (which doesn't bother me so much) , or if I myself mistyped it in one of my configration files (which does bother me). I don't know where to start looking.

Can anyone suggest where to find the answer? I already checked my HOSTS file, which only has only  one line: localhost.

Many thanks.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You can use the message tracking service to find the ndr and the original message but it can't be coming from external otherwise you would need mx records for the mis spelled domain.

Start by examining the users effected to see if they have the mis spelled address listed as a emal address (remember to use exchange active directory users and computers)

Dot think its a recipient policy as this would stamp that address to all your users but check anyway.

Message tracking logs. Find the sender then your in a better position to know.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ClapadorAuthor Commented:
Radweld knew what  the likely cause was and explained what to look for. The only hard part (for me) was figuring out where the logs were and how to search them, since I had never done this before.
ClapadorAuthor Commented:
The culprit was a typo that I made when entering my own e-mail address in Symantec Mail Security for Exchange for it to send me notification of errors. Radweld was correct when he said the  message originated internally,
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.