Exchange 2007 Rejecting Messages
Hey All, We recently installed an exchange 2007 server. Everything seems to work OK. Every now and then an email gets bounced back to the user. According to the protocol logs, I receive this error.
554 5.6.0 Invalid message content
Is there a way to have exchange NOT check message content ?
On the users end, they receive this bounceback. There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <smtp1.primismarketing.com #5.5.0 smtp;554 Transaction failed>
Not sure what the problem is. I checked that the Content Filtering and stuff is not enabled.
Any help someone can provide me with would be really appreciated.
Thanks Steve
June 15th, 2007 6:26pm
Is there anything about the original message that would make it look "spammy". If the user just resends the message, does it get through or rejected the same way:You said that you had not installed the anti-spam agents on the Hub Transport server. Can you enable the protocol logging on the Hub Transport? Then you can see if the message is being rejected by Exchange or if it is even making it to Exchange. The messages might be rejected by your SMTP Proxy.
Free Windows Admin Tool Kit Click here and download it now
June 15th, 2007 10:27pm
I don't think there is anything that makes the address look spammy.
I have enabled protocol logging on the hub Transport.
This is what it looks like.
I changed the email addresses in the log below to prevent some spamming.
The weird thing is a couple of entries earlier everything was fine.
2007-06-15T13:11:02.906Z,HERMES\Default HERMES,08C9728A6AC2E59A,2,10.103.10.9:25,68.119.100.68:40552,>,"220 hermes.cik.local Microsoft ESMTP MAIL Service ready at Fri, 15 Jun 2007 09:11:02 -0400",2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,3,10.103.10.9:25,68.119.100.68:40552,<,EHLO logistics-svr1.Logistics.local,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,4,10.103.10.9:25,68.119.100.68:40552,>,250-hermes.cik.local Hello [68.119.100.68],2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,5,10.103.10.9:25,68.119.100.68:40552,>,250-SIZE,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,6,10.103.10.9:25,68.119.100.68:40552,>,250-PIPELINING,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,7,10.103.10.9:25,68.119.100.68:40552,>,250-DSN,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,8,10.103.10.9:25,68.119.100.68:40552,>,250-ENHANCEDSTATUSCODES,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,9,10.103.10.9:25,68.119.100.68:40552,>,250-STARTTLS,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,10,10.103.10.9:25,68.119.100.68:40552,>,250-X-ANONYMOUSTLS,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,11,10.103.10.9:25,68.119.100.68:40552,>,250-AUTH GSSAPI NTLM,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,12,10.103.10.9:25,68.119.100.68:40552,>,250-X-EXPS GSSAPI NTLM,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,13,10.103.10.9:25,68.119.100.68:40552,>,250-8BITMIME,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,14,10.103.10.9:25,68.119.100.68:40552,>,250-BINARYMIME,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,15,10.103.10.9:25,68.119.100.68:40552,>,250-CHUNKING,2007-06-15T13:11:02.968Z,HERMES\Default HERMES,08C9728A6AC2E59A,16,10.103.10.9:25,68.119.100.68:40552,>,250 XEXCH50,2007-06-15T13:11:03.046Z,HERMES\Default HERMES,08C9728A6AC2E59A,17,10.103.10.9:25,68.119.100.68:40552,<,MAIL FROM:nottherealaddress@computer.com,2007-06-15T13:11:03.046Z,HERMES\Default HERMES,08C9728A6AC2E59A,18,10.103.10.9:25,68.119.100.68:40552,*,08C9728A6AC2E59A;2007-06-15T13:11:02.906Z;1,receiving message2007-06-15T13:11:03.046Z,HERMES\Default HERMES,08C9728A6AC2E59A,19,10.103.10.9:25,68.119.100.68:40552,>,250 2.1.0 Sender OK,2007-06-15T13:11:03.125Z,HERMES\Default HERMES,08C9728A6AC2E59A,20,10.103.10.9:25,68.119.100.68:40552,<,RCPT TO:<user@ourcompany.com>,2007-06-15T13:11:03.125Z,HERMES\Default HERMES,08C9728A6AC2E59A,21,10.103.10.9:25,68.119.100.68:40552,>,250 2.1.5 Recipient OK,2007-06-15T13:11:03.406Z,HERMES\Default HERMES,08C9728A6AC2E59A,22,10.103.10.9:25,68.119.100.68:40552,<,BDAT 10741 LAST,
2007-06-15T13:11:08.500Z,HERMES\Default HERMES,08C9728A6AC2E59A,23,10.103.10.9:25,68.119.100.68:40552,>,554 5.6.0 Invalid message content,2007-06-15T13:11:08.656Z,HERMES\Default HERMES,08C9728A6AC2E59A,24,10.103.10.9:25,68.119.100.68:40552,<,QUIT,2007-06-15T13:11:08.656Z,HERMES\Default HERMES,08C9728A6AC2E59A,25,10.103.10.9:25,68.119.100.68:40552,>,221 2.0.0 Service closing transmission channel,2007-06-15T13:11:08.656Z,HERMES\Default HERMES,08C9728A6AC2E59A,26,10.103.10.9:25,68.119.100.68:40552,-,,Local
June 15th, 2007 10:39pm
Well, here is the most revealing thing:
2007-06-15T13:11:03.406Z,HERMES\Default HERMES,08C9728A6AC2E59A,22,10.103.10.9:25,68.119.100.68:40552,<,BDAT 10741 LAST,
2007-06-15T13:11:08.500Z,HERMES\Default HERMES,08C9728A6AC2E59A,23,10.103.10.9:25,68.119.100.68:40552,>,554 5.6.0 Invalid message content,
This indicates that your server did, in fact, accept the entire message body before it rejected it. That would imply the content filter is at work.
Do you have any Transport Rules? I doubt a transport rule would reject a message in this way, though. Also, double check that the filters are not enabled. At theExchange Management Shell prompt, type Get-TransportAgent. It should look like this:
[PS] C:\>Get-TransportAgent
Identity Enabled Priority-------- ------- --------Transport Rule Agent True 1Journaling Agent True 2
If you see the antispam agents in there, you may need to remove them. There is a script to do this in the \Scripts folder.
Free Windows Admin Tool Kit Click here and download it now
June 16th, 2007 2:20am
When I run that this is what I get.
Identity Enabled Prio-------- ------- ----Transport Rule Agent True 1Journaling Agent True 2
I don't see any anti-spam agents in there.
June 17th, 2007 1:30pm
We are getting the same thing. In our case, Cisco Callmanager is relaying a voicemail through a 2003 org to our org. I have a call open with MS and will post if it is resolved.
It does appear to be related to EX2007. We have one EX2003 server in the org and mailboxes on that server successfully receive the relayed voicemail if the connector in the relay org points to the EX2003 server. If a messagetries tocross the RGC to EX2007 a NDR 554 5.6.0 Invalid message content is then generated.
Free Windows Admin Tool Kit Click here and download it now
June 20th, 2007 7:17am
Does anybody solve this problem?MCSE: Messaging, MCITP: Enterprise Administrator
April 14th, 2009 10:42am
Hello, i have the same problem. I have search a lot of informatin but i can not resolve the problem. Does any body solved it? Thank you
Free Windows Admin Tool Kit Click here and download it now
July 9th, 2009 8:09pm
HelloWe have the same problem, when we try to forward a mail with a specific attachment, but if we save the attachmen and creates a new email with the same attachment the mail is reveived without problemsour receive connector catches this log.2009-09-04T09:28:59.002Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,0,10.0.0.3:25,209.85.218.208:43622,+,,2009-09-04T09:28:59.002Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,1,10.0.0.3:25,209.85.218.208:43622,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions2009-09-04T09:28:59.002Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,2,10.0.0.3:25,209.85.218.208:43622,>,"220 our email server Microsoft ESMTP MAIL Service ready at Fri, 4 Sep 2009 11:28:58 +0200",2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,3,10.0.0.3:25,209.85.218.208:43622,<,EHLO mail-bw0-f208.google.com,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,4,10.0.0.3:25,209.85.218.208:43622,>,250-our mail server Hello [999.999.999.999],2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,5,10.0.0.3:25,209.85.218.208:43622,>,250-SIZE,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,6,10.0.0.3:25,209.85.218.208:43622,>,250-PIPELINING,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,7,10.0.0.3:25,209.85.218.208:43622,>,250-DSN,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,8,10.0.0.3:25,209.85.218.208:43622,>,250-ENHANCEDSTATUSCODES,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,9,10.0.0.3:25,209.85.218.208:43622,>,250-AUTH,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,10,10.0.0.3:25,209.85.218.208:43622,>,250-8BITMIME,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,11,10.0.0.3:25,209.85.218.208:43622,>,250-BINARYMIME,2009-09-04T09:28:59.049Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,12,10.0.0.3:25,209.85.218.208:43622,>,250 CHUNKING,2009-09-04T09:28:59.111Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,13,10.0.0.3:25,209.85.218.208:43622,<,MAIL FROM:<someuser@anydomain.com>,2009-09-04T09:28:59.111Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,14,10.0.0.3:25,209.85.218.208:43622,*,08CBFB4ED364C96C;2009-09-04T09:28:59.002Z;1,receiving message2009-09-04T09:28:59.111Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,15,10.0.0.3:25,209.85.218.208:43622,>,250 2.1.0 Sender OK,2009-09-04T09:28:59.158Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,16,10.0.0.3:25,209.85.218.208:43622,<,RCPT TO:<someuser@ourdomain.com>,2009-09-04T09:28:59.158Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,17,10.0.0.3:25,209.85.218.208:43622,>,250 2.1.5 Recipient OK,2009-09-04T09:28:59.205Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,18,10.0.0.3:25,209.85.218.208:43622,<,DATA,2009-09-04T09:28:59.205Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,19,10.0.0.3:25,209.85.218.208:43622,>,354 Start mail input; end with <CRLF>.<CRLF>,2009-09-04T09:29:49.637Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,20,10.0.0.3:25,209.85.218.208:43622,>,554 5.6.0 Invalid message content,2009-09-04T09:29:49.683Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,21,10.0.0.3:25,209.85.218.208:43622,<,QUIT,2009-09-04T09:29:49.683Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,22,10.0.0.3:25,209.85.218.208:43622,>,221 2.0.0 Service closing transmission channel,2009-09-04T09:29:49.683Z,SINUSMAIL\Default SINUSMAIL,08CBFB4ED364C96C,23,10.0.0.3:25,209.85.218.208:43622,-,,LocalChuii
September 4th, 2009 12:59pm
Did you ever get a resolution to his by MS?
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2010 10:18pm
It is very strange - such a stupid problem without resolution since year 2007 - and I am experiencing it with Exchange 2010:(
Could anybody explain why in addition to this error I am seeing that trying send e-mail is forcing my windows service allocate 100% CPU?
April 2nd, 2010 1:02pm
This sounds more like a mismatch, or perceived mismatch, between the claimed content type in the headers and the actual content of the email than a false positive for being spam.
Free Windows Admin Tool Kit Click here and download it now
April 2nd, 2010 1:30pm
I have the same problem too but on a 2003 server.
Invalid Content error - cant believe that is little to no information about this error anywhere. Has anyone got any fixes for this?
May 26th, 2010 2:19pm
Hi,
Is this email having an attachment ? If so for troubleshooting purposes you might want to ask sender to re-send the enail without attachment and see if it coming through. May be we will be able to derive a patttern. See below link #update 2
http://www.exchangelog.info/2007/05/error-smtp554-552-invalid-data-in.html
Thanks
Shiv
Free Windows Admin Tool Kit Click here and download it now
May 26th, 2010 3:25pm
Hi!
Please check the solution on
http://support.microsoft.com/kb/2203381
Regards
Jimmy Svensson
April 28th, 2011 10:11am