SMTP: Advanced Message Queue Failed to Deliver Message

[tahoe2]

And it's gone! Poof!

SBS2003 with Exchange 2003, SP2.
I just installed Server 2003, SP1, then SBS 2003 SP1.

Since that time, we've been losing emails arbitrarily.
A client will call and ask why we haven't responded to an email, then I track in in Exch Manager.
I see the message come in and as it goes to the advanced queue, it is gone. As in, unfindable anywhere on the server.

The weird thing is, sometimes emails from the same clients get through, sometimes they don't.

Also, no DNR's are received by anyone.

I've completely disabled our spam filter so I could see if somehow that was the culprit, and it still happens.

I've checked relaying, we're not, except to ourselves.

I've changed ports on routers and modems, no go.

I've set and reset filters, started and restarted the smtp virtual server, I'M GOING NUTS!!!

This has been going on for 2 weeks now.
Has anyone heard of this?

 

[tahoe2]

I forgot to say I turned on SMTP filtering, and here is the event that appears around the time of the disappearing email:
EVENT ID: 7010
MSExchange Transport
SMTP Protocol

This is an SMTP protocol log for virtual server ID 1, connection #444. The client at "xx.x.xx.162" sent a "xexch50" command, and the SMTP server responded with "504 Need to authenticate first ". The full command sent was "xexch50 1828 2". This will probably cause the connection to fail.

 

[ShackDaddy]

This event probably isn't related to your issue. Normally your system should allow unauthenticated connections, which don't send "xexch50" commands. Your server should only accept xexch50 commands from other servers in your organization.

When you said you turned on SMTP filtering, did you mean "diagnostic logging"?

This problem is usually caused by a 3rd-party app, GFI's or Symantecs, that pulls mail out of the normal mailstream for one reason or another. I'd focus on that. Do you have MailEssentials or Ninja running?

ShackDaddy
Shackelford Consulting

 

[tahoe2]

Hi, thanks for the reply!

I don't run either of those apps. We use Sophos Pure Message, and I disabled the services, then restarted the server, just to make certain that wasn't it.
I even found an article on GFI website that gave a fix:
re-register the MDAC .dll's in the program files/common files\system\ado.
That did not work either.

As for the filtering, I did mean Diagnostic Logging is enabled. Unfortunately, I don't know how to read the log, it just looks like a bunch of repeated lines.

Also, (having SMTP Filtering in my head) I had filters set for Sender, Recipient and Connection. I had enabled these filters when we upgraded. I disabled them to see if they were the culprit, and that wasn't it.

Thanks for the info one the error. It makes sense, and I can now safely ignore those.

Corie

 

[ShackDaddy]

You are trying out all these things: are you able to reliably duplicate the problem then, or is it a matter of waiting to see what happens now?

ShackDaddy
Shackelford Consulting

 

[tahoe2]

It seems like everything we try helps a little, and the problem is going away in increments.

Before lunch, I changed the network cable from the DSL router to the DC.
Since that time, we have only lost one email to the advanced queue, and that one was spam.

Basically, every 5 minutes, I track every message that comes in.

Before the cable exchange, I could send an email to 4 addresses that are having trouble emailing, and I would only get 0-1 responses. So, yes, I could (semi-reasonably) duplicate the error.
Since I changed cables, I've gotten three tests back from everyone.
Still the matter of the one piece that had the same error.

Thanks,
Corie

 

[ShackDaddy]

Ok, so let's watch it for 48 hours and see where we're at.

ShackDaddy
Shackelford Consulting

 

[tahoe2]

ShackDaddy, I am now at the point where, when I get the error, it is the spam filter grabbing the emai9l. So far, it's all been spam, so I'll contact Sophos to see what the fix is.
Thanks!