In Exchange 2007, does anyone know how I can check if an NDR was generated by Exchange for a message that wasn't delivered? I have a situation where a message was sent from an internal user to an external recipient. For whatever reason, the mesage seems to have been 'lost' when being transported across Hub Transports. External mail is supposed to go from the local Hub > HQ Hub > HQ Hub2 > SMTP Gateway, however message tracking log has it being delivered to HQ Hub, and that's it. I want to know if an NDR was generated for this loss, how can I check that? WHat would be the source address to check for in Message tracking logs?

If the NDR had been generated by Exchange, it would show in the message tracking log. The usual reason for no NDR is that the message was blocked by AV/Antispam etc. Simon. Simon Butler, Exchange MVP Blog | Exchange Resources | In the UK? Hire Me.

On Wed, 30 Mar 2011 21:00:03 +0000, Chuck_P2101 wrote: >In Exchange 2007, does anyone know how I can check if an NDR was generated by Exchange for a message that wasn't delivered? The message tracking tool will show you "FAIL" and "DSN" events. >I have a situation where a message was sent from an internal user to an external recipient. For whatever reason, the mesage seems to have been 'lost' when being transported across Hub Transports. External mail is supposed to go from the local Hub > HQ Hub > HQ Hub2 > SMTP Gateway, however message tracking log has it being delivered to HQ Hub, and that's it. > >I want to know if an NDR was generated for this loss, how can I check that? See above. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

So the original message tracking log for that message SHOULD contains a FAIL and DSN event? There is nothing extra I need to do to search for it? In terms of finding out what happend to the message, what's the best way?

On Thu, 31 Mar 2011 07:43:46 +0000, Chuck_P2101 wrote: >So the original message tracking log for that message SHOULD contains a FAIL and DSN event? No, the message tracking log on the machine that generated the failure would have that in the log. The log on the transmitting server would only have the SMTP delivery. >There is nothing extra I need to do to search for it? No, the DSN event should have the reson for the failure. >In terms of finding out what happend to the message, what's the best way? Event logs, message tracking logs, and SMTP protocol logs. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

>No, the message tracking log on the machine that generated the failure >would have that in the log. The log on the transmitting server would >only have the SMTP delivery. Ok, so let's say I know what the Sender/ Recipient/ Subject was for a message. I run a command to check for this message on all Hub Transport servers in our organisation. I see that the message didn't make it out. I want to know if the user was sent an NDR stating so. - Am I correct in thinking that an NDR is generated only if there is a FAIL event? - Given that I know the Sender/Recpient/ Subject only, and that's what I'm searching on, how can I check if an NDR was generated? Since the Sender and Recipient would have changed?

On Sat, 2 Apr 2011 10:40:20 +0000, Chuck_P2101 wrote: >>No, the message tracking log on the machine that generated the failure >>would have that in the log. The log on the transmitting server would >>only have the SMTP delivery. >Ok, so let's say I know what the Sender/ Recipient/ Subject was for a message. I run a command to check for this message on all Hub Transport servers in our organisation. I see that the message didn't make it out. I want to know if the user was sent an NDR stating so. - Am I correct in thinking that an NDR is generated only if there is a FAIL event? Well, yes, for a NDR. But you won't find "NDR" in the message tracking log -- you'll only find "DSN". A NDR is just one case of a DSN. >Given that I know the Sender/Recpient/ Subject only, and that's what I'm searching on, how can I check if an NDR was generated? Since the Sender and Recipient would have changed? Are you using the EMC toolbox or the EMS cmdlet? If you use the EMC toolbox, find the message, select one of the events and then click "Next". That'll follow the message to the next hop. Repeat until you find the failure (or the last hop). --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

>>Given that I know the Sender/Recpient/ Subject only, and that's what I'm searching on, how can I check if an NDR was generated? Since the Sender and Recipient would have changed? >Are you using the EMC toolbox or the EMS cmdlet? If you use the EMC toolbox, find the message, select one of the events and then click "Next". That'll follow the message to the next hop. Repeat until you find the failure (or the last hop). Using the EMS cmdlet. So, as an example, I run get-messagetrackinglog -sender SENDER -recipients RECIPIENTS Within the return I get for that I see a FAIL event. Does that mean a DSN has been generated? So to put this another way, for what events are DSN's generated? How can I see if DSN's are generated for a particular message?

On Tue, 19 Apr 2011 21:35:04 +0000, Chuck_P2101 wrote: >>>Given that I know the Sender/Recpient/ Subject only, and that's what I'm searching on, how can I check if an NDR was generated? Since the Sender and Recipient would have changed? >>Are you using the EMC toolbox or the EMS cmdlet? If you use the EMC toolbox, find the message, select one of the events and then click "Next". That'll follow the message to the next hop. Repeat until you find the failure (or the last hop). >Using the EMS cmdlet. So, as an example, I run get-messagetrackinglog -sender SENDER -recipients RECIPIENTS Within the return I get for that I see a FAIL event. Does that mean a DSN has been generated? No, it means that there was a failure. If you have only a single multi-role server, use the message-id instead of the recipients as the search argument. You should see all the events. Otherwise, perform the same search on each of the servers using the message-id. >So to put this another way, for what events are DSN's generated? Only those for which DSNs are allowed. >How can I see if DSN's are generated for a particular message? By using the message-id. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP