Do you mean the email address that the NDR comes from, i.e. your server's name, or the text of the NDR message?  Could you give us a screen shot say of what you mean?

Steve

Hi Steve,
I mean the email address in the TO field of the NDR(see attachement), the one the server used to send all NDR.

Still confused, sorry, what you show is normal?

A NDR  will show as coming from "Mail router" and if you looked at the from address it would be yours.
The To address is the one you were trying to send to.

Are you getting junk NDR's i.e. ones you haven't sent the original mail, in which case need to track down whether it is coming from your network or server or junk mail sent from your domain name by others in which case implement SPF in DNS will help a lot.

Steve

Hi Steve,

Thanks for your feedback.
I'm a little bit confused myself.

The NDR is send FROM Postmaster@myhomedomain.com  TO helpdesk@myotherhomedomain.com
Here after the full SMTP message.
The more i see it the more  i'm thinking about spam to the mailbox postmaster.
Since I'm not really familiar with Domino, and wonder if the domino server would not have somewhere a setting that send a copy of the NDR to the mailbox helpdesk@myotherhomedomain.com.

Message source:

Date: Tue, 06 Oct 2015 18:12:18 +0800
MIME-Version: 1.0
Subject: DELIVERY FAILURE: Error transferring to mail.SAGADENT.COM.UA; SMTP Protocol
 Returned a Permanent Error 550 relay not permitted
From: Postmaster@myhomedomain.com
To: helpdesk@myotherhomedomain.com
X-MIMETrack: Itemize by SMTP Server on mydominoserver(Release 8.5 HF1|December 29, 2008) at 10/06/2015 06:12:14 PM,
		 Serialize by Notes Client on mylotusaccount(Release 8.5.3|September 15, 2011) at 07/10/2015 14:50:27,
		 Serialize complete at 07/10/2015 14:50:27
Message-ID: <OFDDA75E99.6BB898D5-ON48257ED6.00380D38-48257ED6.0039731E@myhomedomain.com>
Content-Type: multipart/report; report-type=delivery-status; boundary="==IFJRGLKFGIR87242UHRUHIHD"

--==IFJRGLKFGIR87242UHRUHIHD
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64

--==IFJRGLKFGIR87242UHRUHIHD
Content-Type: message/delivery-status

Reporting-MTA: dns;webmail.myotherhomedomain.com

Final-Recipient: rfc822;sales@sagadent.com.ua
Action: failed
Status: 5.0.0
Remote-MTA: smtp;mail.SAGADENT.COM.UA
Diagnostic-Code: X-Notes; Error transferring to mail.SAGADENT.COM.UA; 
 SMTP Protocol Returned a Permanent Error 550 relay not permitted

--==IFJRGLKFGIR87242UHRUHIHD
Content-Type: message/rfc822

Received: from mysmtpgateway.myotherhomedomain.com ([10.85.1.16])
          by webmail.myotherhomedomain.com (Lotus Domino Release 8.5 HF1)
          with ESMTP id 2015100618121400-16212 ;
          Tue, 6 Oct 2015 18:12:14 +0800 
Date: Tue, 06 Oct 2015 18:12:18 +0800
MIME-Version: 1.0
Subject: Executable File Violation
From: helpdesk@myotherhomedomain.com
To: sales@sagadent.com.ua
X-MIMETrack: Itemize by SMTP Server on mydominoserver(Release 8.5 HF1|December 29, 2008) at 10/06/2015 06:12:14 PM,
		 Serialize by Notes Client on mylotusaccount(Release 8.5.3|September 15, 2011) at 07/10/2015 14:50:27,
		 Serialize complete at 07/10/2015 14:50:27
Message-ID: <OFDDA75E99.6BB898D5-ON48257ED6.00380D38-48257ED6.0039731E@myhomedomain.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"

You attempted to send a message that contained an executable file.  Our company policy prohibits the sending of executable files via email.  The message was not delivered.

--==IFJRGLKFGIR87242UHRUHIHD--

Select allOpen in new window

Both myhomedomain.com and myotherhomedomain.com are domains that belong to us.
Both domain have their own home hosted domino server.
mysmtpgateway.myotherhomedomain.com is the host link to the primary incoming MX record for both domains.

helpdesk@myotherhomedomain.com is barely used today, no trace of any documents sent to the "@sagadent.com.ua" which confirmed your theory.
I also discover that the postmaster@myhomedomain.com is an internet address attach to a lotus admin account (not really smart from those who installed domino).

As immediate action i did:
-change postmaster email address on that admin account so that it can't be identify as valid sender.
-add domain sagadent.com.ua to my blacklist on the mysmtpgateway Symantec Messaging Gateway.

I will monitor the traffic for the next day and see if i still received those NDR.

Thank you very much for help.

ok, good luck, can always be bit difficult to track down... if it comes to it can do smtp debugging ot mail tracking to see which server they really start from.  Post back here if you need to.

Steve

This is permission related SMTP error you can mail to me full report of log.nsf,my mail Id is nitesh9868@outlook.com