I recenlty set up a transport rule to stop certain emails getting from one address to another as the sender was cc'ing in somebody who we didn't want to be seeing the email. So I set up a rule that says if this user is in the CC or TO field and the From address contains joebloggs@sender.com then forward to myself and my colleague for moderation. My thinking was we could then send it through to the necessary people. I was checking through the queues today however and we had a message from the sender today and it's gone straight into the Poison Message queue. Now I understand what the Poison Message queue does and is there for but I'm not sure if my rule could have had an effect on that as we've had some from this sender prior to this and they've never been a problem. Could it be that the sender has purposefully sent a harmful email (in which case I would imagine our PureMessage would of picked up) or it has just been framed poorly. I've exported the message and opened it on another system and all looks legit but I don't know what could be lurking in the background. For now I plan on just copying the text out and passing it on but worried what happens if one day I don't check the poison queue and we miss an important email. I can't see how my transport rule would cause it to go there but want to be sure before I look further into. Any ideas?

I doubt the rule would dump it in the poision queue, usually some malformed or exceptions in the message itself does that. The only way to determine the nature of the exception is to setup pipeline tracking. Using Pipeline Tracing to Diagnose Transport Agent Problems http://technet.microsoft.com/en-us/library/bb125198(v=exchg.80).aspxJames Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

I exported the message last week and left it at that but had another by the same guy trapped in the poison queue today so enabled pipeline tracing and let it through. Now it's stuck in the 'submission' queue and doesn't seem to be doing much. There are 3 recipients and the status is ready on 2 and complete on one but the completed one has a 'last error' value of; 250 2.1.5 RESOLVER.FWD.Forwarded; recipient forwarded Any idea why this could now be happening? Have been looking online but been unable to find anything with this error.