locked
Badmail Problem RRS feed

  • 問題

  • I'm using SMB Exchange 2003 with SP2, I've turn on a function "Archive all messages sent or received by mailboxes on this store", all of the in/out email should forward to "mbackup" mailbox.

    Now, I found that some of our incoming email (External or Internal) were defined as Badmail, so that end-user can't receive the email. But that email can deliver to mbackup. So, I tried to forward that email from mbackup to end-user, it's works.

    I've got 10 to 20 above cases per day. I don't why it was happended such that case and how come it's working fine when I forward the email from mbackup to end-user?

    Here is the log of message history from Message Tracking Center.

    SMTP: Message submitted to advanced queuing

    SMTP: Started Message submission to advanced queue

    SMTP: Message submitted to categorizer

    SMTP: Message sent to Badmail

    SMTP: Message Categorized and queued for routing

    SMTP: Message queued for local delivery

    SMTP: Message delivered locally to mbackup@abc.com.hk

    SMTP: Store Driver: Message delivered Locally to store to mbackup@abc.com.hk


    Here is the log from event viewer

    Source: Symantec Mail Security for Exchange Server
    Category : Unscannable
    Event ID : 348

    Description : SMTP scanning failed on the message with subject: "xxxxxxxx". This message has been set as bad mail on the SMTP server.


    ANYBODY CAN HELP ME??

    2009年3月13日 上午 04:55

解答

  • Dear Lawrence,

     

    Based on my research, I found the same issue and resolution in our internal knowledge base article. You can try the following steps to fix the issue:

     

    Method 1: Disable the antivirus or unhook any other third party event sinks attached with default smtp sinks and restart the SMTP service.

    Method 2: Contact the antivirus vendor and get the latest updates.

     

    If the issue still persists, please send the e-mail under BadMail folder to me for analyze.

     

    Rock Wang


    Rock Wang– MSFT
    2009年3月18日 下午 12:27

所有回覆

  • Dear Lawrence,

     

    From your post, I know you have installed Symantec Mail Security on your Exchange server. This may cause the issue.

     

    Please try to uncheck the Transport Scanning in Symantec Mail Security and check the effect.

     

    If the issue still persists, please collect application log file according to the following steps:

     

    1.       Open Event Viewer, navigate to application and right click it, select clean up,

    2.       According to the following steps to turn all category under Transport to Maximum,

     

    a)         Start Exchange System Manager.

    b)         Expand Servers, right-click Your_ Server_Name, and then click Properties.

    c)         Click the Diagnostics Logging tab, and then click MSExchangeTransport under Services.

    d)         Under Categories, select each category and set logging level to Maximum respectively.

     

    3.       Reproduce the issue and save the application log as .evt file, send the file to v-rocwan@microsoft.com for analyze.

     

    How to troubleshoot for Exchange Server 2003 transport issues

    http://support.microsoft.com/kb/821910/en-us

     

    If anything is unclear, feel free to let me know.

     

    Note: when you send e-mail to me, please let me know the URL of the post.

     

    Regards,

    Rock Wang


    Rock Wang– MSFT
    2009年3月16日 上午 02:21
  • Hi Rock, 

    According to your suggestion, I can’t find the Transport scanning in Symantec Mail Security but I can find Unscannable File Rule and it was set to be Log only.

    And I’ve asked Symantec engineer they said that our current unscannable setting is just only for logging, it would not take any action.

     

    Now, I still have the bad mail issue and do you have any idea?

    PS. I've sent the application event log via email.

    Regards,
    Lawrence So

    2009年3月18日 上午 01:34
  • Dear Lawrence,

     

    Based on my research, I found the same issue and resolution in our internal knowledge base article. You can try the following steps to fix the issue:

     

    Method 1: Disable the antivirus or unhook any other third party event sinks attached with default smtp sinks and restart the SMTP service.

    Method 2: Contact the antivirus vendor and get the latest updates.

     

    If the issue still persists, please send the e-mail under BadMail folder to me for analyze.

     

    Rock Wang


    Rock Wang– MSFT
    2009年3月18日 下午 12:27
  • Hello Rock,

    In method 1, do you mean to disable the virus scanning from Symantec Mail Security for MS Exchange?
    I've forwarded all information to Norton Support, then they said that the setting of my server for unscannable email is just for logging, it wouldn't be delete/quarantine this kind of email.

    Actually, the problem still exists in our server.
    • 已標示為解答 Lawrence So 2009年3月24日 上午 04:56
    • 已取消標示為解答 Lawrence So 2009年3月24日 上午 04:57
    • 已標示為解答 Lawrence So 2009年3月24日 上午 04:58
    • 已取消標示為解答 Lawrence So 2009年3月24日 上午 04:58
    2009年3月24日 上午 04:54
  •  

    Hi Lawrence,

     

    You can try the following suggestions:

     

    1. Examine the .bdr file to determine the reason for these messages being placed into the BadMail folder. A .bdr file is the body of the NDR. A .bdr file includes the error code, the message sender, and the message recipients. You can send .bdr file to v-rocwan@microsoft.com.

     

    2. Review and Research the Windows Event Viewer Event logs for errors or warnings related to this issue.

     

    3. Run Exchange Troubleshooting Analyzer (ExTRA) and select the Mail Flow Troubleshooter to troubleshoot Mailflow and transport-related problems.

     

    http://www.microsoft.com/downloads/details.aspx?familyid=4BDC1D6B-DE34-4F1C-AEBA-FED1256CAF9A&displaylang=en

     

    4. Run the Exchange Best Practices Analyzer to narrow the issue:

     

    873290 How to use the Microsoft Exchange Server Best Practices Analyzer tool to collect and analyze data in an Exchange 2000 organization or in an Exchange 2003 organization

    http://www.microsoft.com/downloads/details.aspx?familyid=dbab201f-4bee-4943-ac22-e2ddbd258df3&displaylang=en

     

    If anything is unclear, feel free to let me know.

     

    Regards,

    Rock Wang


    Rock Wang– MSFT
    2009年3月24日 上午 08:38