I use postini to fight SPAM, but still seem to be under an NDR attack. SMTP & Message tracking logs are large (~15MB a day) for a 100 user company. Mostly they are filled with Delivery Status Notifications from postmaster@mycompnay.com to outside emails. I did disable NDR reports on the exchange side more than 48 hours and expected all messages to expire by now. Searching for a message from postmaster in the message tracking logs returns multiple records with Delivery Status Notification (Failure) All messages have two events SMTP: Started Message Submission to Advance Queue SMTP: Message Submitted to Categorizer I don't think Postini has a copy of my AD, so is this considered normal?

Filter Recipients who are not in the directory was enabled, but Apply Recipient Filter was not checked under SMTP server. Is there anything else I need to check?

Hello, For the events: SMTP: Started Message Submission to Advance Queue SMTP: Message Submitted to Categorizer I suggest you follow this document to increase the logging level for transport components on the Exchange Server. When this issue occur again, try to find whether there is any related information in the logs. How to Modify Logging Settings for MSExchangeTransport http://technet.microsoft.com/en-us/library/bb124596(EXCHG.65).aspx Thanks, EvanEvan Liu TechNet Community Support

Hello, For the events: SMTP: Started Message Submission to Advance Queue SMTP: Message Submitted to Categorizer I suggest you follow this document to increase the logging level for transport components on the Exchange Server. When this issue occur again, try to find whether there is any related information in the logs. How to Modify Logging Settings for MSExchangeTransport http://technet.microsoft.com/en-us/library/bb124596(EXCHG.65).aspx Thanks, EvanEvan Liu TechNet Community Support