asked on

Found empty sender address mail stuck in queue of Exchange 2k10

This is using MS Exchange server 2010 on MS Windows 2008 R2 server. Recently, in queue viewer, found quite a lot of stuck mail with empty sender address. Please refer to the attached file.

Is this some kind of spamming that want to send via my exchange server? How to stop it? almost all of these stuck mails have error message - 421 4.4.2 Connection dropped due to socket errors.

Thanks in advance.
421---4.4.2-error.bmp

Miguel Angel Perez Muñoz

This appears to be NDR, you may be flooded to inexistent email address and this generates NDR to inexistent domains. This causes your server couldn´t reach to this domains and emails stucks on queue. After 2 days will be remove automatically.

Gareth Gudger

These are just Non-Delivery Reports (NDRs) coming back. Could be a result of an NDR backscatter attack.

Articles on Backscatter.
http://technet.microsoft.com/en-us/library/dn499795(v=exchg.150).aspx
http://www.sophos.com/en-us/support/knowledgebase/37088.aspx

ASKER CERTIFIED SOLUTION

Sudhir Bidye

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

MichaelBalack

ASKER

Hi Sudhir,

Ok, will do it ...

MichaelBalack

ASKER

I've requested that this question be closed as follows:

Accepted answer: 0 points for MichaelBalack's comment #a40528793

for the following reason:

ok

Gareth Gudger

Did you mean to close it that way Michael?

MichaelBalack

ASKER

yes

MichaelBalack

ASKER

Hi Sudhir,

Exchange server is not open relay. However, found few PC were infected by malware/virus that broadcast emails to some invalid recipients, thus jam up the mail queue. After getting rid of the malware/virus, no more stuck mail with sender address "empty".