Email Forwarding Gets Lost in Exchange due to msExchGenericForwardingAddress not having its attribute removed

I have a server running Windows Server 2008 R2 with Exchange 2010 on a recently upgraded forest of 2008 R2.  (It was a hybrid for a long time before that).

The Way It Was: We had email being forwarded from a local mailbox to an offsite email account (on another organizations exchange server)  .  The box to have it sent to both the forwarded and local mailbox was checked.

What I did: Under the mailflow settings tab, under delivery options: I unchecked the "Forward to" mailbox.  

What Happened: All email was no longer being delivered to either the local or the forwarded mailbox.

Troubleshooting: We determined that when we were forwarding email with messages going to both local and forwarded address, everything worked.  When we removed it, no one received email.  

I went into the attributes and found that the msExchGenericForwardingAddress had the forwarded email address.  I unchecked the email forwarding box,.  Removed this email address and email worked for the local mailbox as per normal.

The Problem: Where did the email go?  I checked the outbound spamfilter and during the time in which forwarding email was unchecked it did not go into the local mailbox, but neither was it forwarded.  I checked the transport rules and it seems to be forwarding correctly, but the email does not reach spamfilter (postini).

Other: Journaling is not active, neither is the email able to be restored from deleted items (as it never reached the mailbox in the first place), so retention policies are pointless.

I am looking to find / restore the emails lost for about 4 hours this morning.

Thank you all!
CitadelnyAsked:
Who is Participating?
 
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
Message Tracking should show the SMTP header of the server receiving the message - which would be your external spam filter.
However it would appear that the message has been lost.

Simon.
0
 
Exchange_FreakCommented:
Are you using any inbound spam filter like mxlogic or messagelabs where you can look for emails if they are still there?

Badal Joshi
[edited by SouthMod to remove signature]
0
 
Simon Butler (Sembee)ConsultantCommented:
Message Tracking will tell you what Exchange did with the message. It was probably dropped in to a black hole and has been lost.  You can do the same thing with a distribution group that has no members.

Simon.
0
 
CitadelnyAuthor Commented:
Bidel: The inbound spamfilter (postini) doesn't cache the messages if the exchange server is active.  

Simon: Message track says it was "sent" to that forwarding address.  But the outbound spamfilter doesn't reflect that (hence it wasn't actually sent).  Lost to the void?
0
All Courses

From novice to tech pro — start learning today.