Hey all,Im having a problem with these alerts. I am receiving at least a few of these per day. I have NDR logging disabled under diagnostic logging for the server in question, also I have unchecked the Allow Non-Delivery Reports under global settings, internet message format.Any help on this matter would be greatly appreciated. I really need to get these errors cleared out of the event logs.Thanks

Hi all,Still really hoping someone can help me out here. As mentioned I have logging for these alerts disabled in all the locations I have been able to find as part of Microsoft's documentation towards them yet I still a receive a couple - few a day.

Hi, Whether any exact symptom was encountered or just received the Event 3018 error? If this issue was related to NDR, I need to confirm whether any delivery issue was encountered when sending or receiving the email. Please past the error message of the event log and describe the issue in detail. Thanks Allen

I think the biggest issue here is users sending emails to a no longer existant accounts, our employees email companies with high turnover rates so its not surprising to me we receive these errors but some days I might receive 50+ of these in my event logs. They are almost always if not always 5.4.0's. Examples are listed below, they are all the same but the addresses differ (i have replaced our domain name for confidentially reasons).Event Type: ErrorEvent Source: MSExchangeTransportEvent Category: NDR Event ID: 3018Date: 7/4/2008Time: 3:52:40 AMUser: N/AComputer: EXCHANGE2Description:A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;phil@southworthschysler.com (Message-ID <EXCHANGE2FRaqbC8wSA00000632@domain.xxx>). Causes: This message indicates a DNS problem or an IP address configuration problem Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format. For more information, click http://www.microsoft.com/contentredirect.asp.Data:0000: ef 02 04 c0 .. Event Type: ErrorEvent Source: MSExchangeTransportEvent Category: NDR Event ID: 3018Date: 7/4/2008Time: 4:30:20 AMUser: N/AComputer: EXCHANGE2Description:A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;amanessy@oaksvillehonda.com (Message-ID <EXCHANGE2GXix4A2Dre00000656@domain.xxx>). Causes: This message indicates a DNS problem or an IP address configuration problem Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format. For more information, click http://www.microsoft.com/contentredirect.asp.Data:0000: ef 02 04 c0 .. A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;Pkgroman@oaksvillehonda.com (Message-ID <EXCHANGE2GXix4A2Dre00000656@domain.xxxt>). Causes: This message indicates a DNS problem or an IP address configuration problem Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format. For more information, click http://www.microsoft.com/contentredirect.asp.

Hi, First I would like to confirm whether the above email addresses are valid and real address or fake and nonexistent address. It seems that these address spaces are fake domain. Thus, please take the following steps to prevent the email from being sent to the invalid email address. http://support.microsoft.com/default.aspx?scid=kb;EN-US;821746 Thanks Allen

Allen,First of all thanks for the reply. Secondly though, I am not sure how the suggested kb article is suppose to help. As I already mentioned in my previous post our users send thousands of emails per week and sometimes per day to different dealerships and people. Its expected that some of the dealerships will not always be available, will shutdown, or change their dns names. As such I do not need or want to receive these 3018 alerts whenever this happens to be the case. We have about 130 programs which house different email addresses for different vendors and dealership products, it is impossible to stay current with everyone of these addresses.As stated, I would just assume disable the 3018 from being logged at all whether this is supported or not.

Hi, Appreciate your clearly explanation on this issue. Currently I understand that your situation. In fact, we cannot disable the event error for certain Event ID of the NDR. The only way is disable the whole kind of the NDR. As you said, we need to set the NDR to None level under MSExchangeTransport in Diagnostics Logging tab. But the disadvantage is we are unable to examine the issue when the email failed to be sent due to other causes. Thus, I dont recommend to do this. Thanks Allen

Thanks for the info Allen. As mentioned earlier I have actually previously set the logging level for NDR's on the MSExchangeTransport in Diagnostics tab to None but I still get some of these alerts slipping through. Any idea on why?

Hi, Thats normal since the None option represents the level of the Diagnostic Logging is the lowest and can reduce a part of the event error but not means the error can be filtered completely. For Exchange, it will make a judge and identify which error is critical or general. If the error is recognized as critical, it will still be displayed no matter what logging level has been set. That will be very helpful from the troubleshooting side. Thank you for your understanding. Thanks Allen