Microsoft Exchange 2007 NDRs (Non-delivery Reports)
Let us suppose that Outlook sends an email to recipient on an Exchange 2007 server,
however, that server calculates that it cannot deliver
the message - what happens next? The answer is the 'Generating Server'
sends a NDR (Non-delivery Report) back to the sender's
At first, it comes as a revelation when you discover that there is more than one type of
Exchange 2007 NDR. Then you discover that NDRs have enhanced status codes. Furthermore, each code
number gives you
extra information about the cause of the email delivery problem. This
page will help you
these NDR codes.
Topics for Exchange 2007 NDRs (Non-delivery reports)
When you examine the diagnostic information in a NDR message, make a note of the three-digit code, for example, 5.3.1.
In Exchange 2007, these are know as 'Common Enhanced Status Codes'.
If the first number begins with 5, then it means you are dealing with a permanent error; this message will never be delivered. Occasionally, you get
an Exchange NDR beginning with
4, in which case there is hope that email will eventually get through. The place to look for this NDR status code is on the last line
of the report.
NDR codes such as 5.5.0, or 4.3.1, may remind you of SMTP errors 550 and 431. Indeed, the 500 series in SMTP has a similar meaning to the 5.y.z codes in an NDR - failure.
Perhaps you have worked out why there are no 2.y.z Exchange NDRs? The reason
being the 2.y.z series mean success, whereas Non-delivery Reports, by definition, are
NDR Classification for Common Enhanced Status Codes Clearly these status codes are not random
numbers, thus we can detect patterns. The first number 4.y.z, or 5.y.z refers to the class of code, for example, 5.y.z is permanent error. Incidentally, I have not seen any status codes beginning
with 1.y.z, 3.y.z, or have I seen any numbers greater than 5.7.z.
The second number x.1.z means subject. This second digit,
1 in the previous example, gives generic information, whereas the third digit (z) gives detail. Unfortunately, I have not cracked the
complete code for the second digit. However, I have discovered a few useful patterns, for instance, 5.1.x indicates a problem with the email address, as apposed to server or connector problem.
In addition, 5.2.x means that the email is too
big, therefore I recommend checking the message limit setting on the
Exchange 2007 server.
Here below is an example of an email sent to a non-existent user. There is no
jethro mailbox on the worcester server. In the body of the NDR, you can see the name of the domain (exchJethro.com), the
and the NDR status code (5.1.1). In your examples, always seek out the servername in the
Received: from server (IP Address) of your NDR.
Your message did not reach some or all of the intended recipients.
email@example.com on 06/05/2008
10:23 PM The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address. <worcester.exchJethro.com
Guy Recommends: A Free Trial of the Network Performance Monitor
Network Performance Monitor
will help you discover what's happening on your network. This
utility will also guide you through troubleshooting; the dashboard will
indicate whether the root cause is a broken link, faulty equipment or
What I like best is the way NPM suggests solutions to network
also has the ability to monitor the health of individual VMware
virtual machines. If you are interested in troubleshooting, and creating
network maps, then I recommend that you try NPM now.
Explanation of Enhanced Status Codes in Exchange 2007 NDRs
The recipient has exceeded their mailbox limit.
It could also be that the delivery directory on the Virtual
server has exceeded its limit.
Insufficient system resources. This normally means not enough disk space on the delivery server.
Microsoft say this Exchange NDR maybe reported as out-of-memory error.
A classic temporary problem. Most likely, the Administrator has frozen the queue.
Intermittent network connection. The server has not yet responded. Classic
time-out problem. If it persists, you will also get a 5.4.x status code error.
The server started to deliver the message but then the connection was
dropped. The sending server is configured to retry
Too many hops. Most likely, the message is looping.
Problem with a protocol timeout, for example a message
header limit. Check receiving server connectors.
A DNS problem. Check your smart host setting on the SMTP connector. For example, check correct SMTP format. Also, use square brackets in the IP address [184.108.40.206] You can get this same NDR error if you have been deleting routing groups.
Multi-language situation. Your server does not have the correct language code page installed.
SMTP 500 reply code means an unrecognised address. You get this NDR when you make a typing mistake when you manually try to send email via telnet.
The most likely cause is a routing error. One solution
maybe to add an * in the address space.
A separate cause for NDR 5.0.0 is a DNS problem.
The SolarWinds Exchange Monitor
Here is a
free tool to monitor your Exchange Server. Download and
install the utility, then inspect your mail queues, monitor the Exchange
server's memory, confirm there is enough disk space and check the CPU
This is the real deal - there is no catch. SolarWinds provides this
fully-functioning freebie, as part of their commitment to supporting
the network management community.
Often seen with contacts. Verify the recipient address.
Mismatched Network Card duplex setting.
Bad destination mailbox address. 5.1.1 is the most
common Exchange 2007 NDR; there is a problem with the recipient address.
Maybe the recipient does not exist.
Possibly the user was moved to another server in Active Directory.
Check mailbox delegation.
Maybe an Outlook client replied to a message while offline.
Check connector configuration.
SMTP; 550 Host unknown. An error is triggered when the host name can't be found. For example, when trying to send an email to bob@ nonexistantdomain.com. [Example
kindly sent in by Paul T.]
Invalid recipient address. Another problem often seen with
contacts. Address field maybe empty. Check the address
information. Or there could be a syntax error.
Destination mailbox address ambiguous.
Two objects have the same address, which confuses the Exchange 2007 Categorizer.
Destination mailbox address invalid.
Problem with homeMDB or msExchHomeServerName - check how many users are affected. Sometimes running RUS (Recipient Update Service) cures this problem. Mailbox may have moved.
Problem with senders mail attribute, check properties sheet in ADUC.
Something the matter with sender's address
NDR caused by the large size of the email.
Mailbox cannot be accessed. Perhaps the message is too large.
Alternatively, the mailbox has been disabled, or is offline.
Check the recipient's mailbox.
Else it could be a permissions problem, particularly on a
Public Folder. If so, try this PowerShell Command:
Sadly, the recipient has exceeded their mailbox storage
Recipient cannot receive messages this big. The server or connector limit exceeded.
Try resending the message without the attachment.
Most likely, a distribution list or group is trying to send an email. Check where the expansion server is situated.
The application event log may have an Event ID 6025 or 6026,
which has more detailed information.
Problem with MTA, maybe someone has been editing the registry to disable the MTA / Store driver.
Mail system full. Disk full problem on the mailbox server?
System not accepting network messages. Look outside Exchange for a connectivity problem.
Remote server has insufficient disk space to hold email. Check SMTP log.
This error often happens when the sending server is using an
ESMTP BDAT command.
Message too big. Check the limits on both the sender
and receiver side. There maybe a policy in operation.
System incorrectly configured.
Multiple Virtual Servers are using the same IP address and port. See Microsoft TechNet article: 321721 Sharing SMTP. Email probably looping.
DNS Problem. Check the Smart host, or check your DNS. It means that there is no DNS server that can resolve this email address. Could be Virtual Server SMTP address.
No answer from host. Not Exchange's fault check connections.
Routing server failure. No available route.
Cannot find the next hop, check the Routing Group Connector. Perhaps you have Exchange servers in different Routing Groups, but no connector.
Configuring an MX record may help.
Tricky looping problem, a contact has the same email address as an Active Directory user.
One user is probably using an Alternate Recipient with the same email address as a contact.
Check recipient policy.
Delivery time-out. Message is taking too long to be delivered.
Microsoft advise, check your recipient policy. SMTP address should be
yourdom.com. NOT server.yourdom.com.
Underlying SMTP 500 error. Our server tried ehlo, the recipient's server did not understand and returned a 550 or 500 error. Set up SMTP logging.
Invalid command. (Rare Exchange NDR)
Possibly the disk holding the operating system is full.
Alternatively, it could be a syntax error if you are
executing SMTP from telnet.
Too many recipients.
More than 5,000 recipients. Check the Global Settings, Message Delivery properties.
Try resending the same message to fewer recipients.
Invalid domain name. The true cause maybe an invalid
Wrong protocol version.
Invalid message content. This is a protocol error,
thus you should get more information by looking in the
Corrupt message content. Try sending without
Media not supported.
More than 250 attachments.
A very common Exchange 2007 NDR, the cause is a permissions problem. For some reason the sender is not allowed to email this account.
Perhaps an anonymous user is trying to send mail to a distribution list.
Alternatively, a user may have a manually created email address that does not match a
Virtual Server Access Tab. Try checking this box: Allow computers which successfully authenticate to relay.
Check the outgoing SMTP logs.
Check: Mailbox - <Mailboxname> - Properties - Mail Flow
Settings - Message delivery restrictions.
Try disabling Windows-Integrated-Security. Instead
allow only standard authorization on the SMTP receiver on
the Exchange 2007 server.
Check Attachment filtering on the Edge server.
Distribution list cannot expand and so is unable to deliver its messages.
Not Authorized, security problem. It could be that the sender cannot
send to the alternative address.
On another tack, check external IP address of ISA server. Make sure it matches the SMTP publishing rule.
Extra security features not supported. Check delivery server settings
Cryptographic failure. Try a plain message with encryption.
Certificate problem, encryption level maybe to high.
Message integrity problem.
Guy Recommends : SolarWinds'
Free VM Monitor
The best feature of this new this new version of SolarWinds VM Monitor is that it
checks Windows Hyper-V. Naturally, it still works with virtual machines on VMware ESX Servers. VM Monitor is a
desktop tool that not only tests that your server is online, but also
displays the CPU and memory utilization for each node.
It's easy to install and to configure this virtual machine monitor, all
you need the host server's IP address or hostname and the logon info. Give
this virtual machine monitor a try - it's free.
Exchange Mail Flow Tools 1) Launch the Exchange Management Console
2) Click on the Toolbox
3) Examine the Mail flow Tools
Alternatively: Download the Microsoft Exchange Troubleshooting Assistant v1.1, one of
its components is the Exchange Mail Flow Troubleshooter. Here are some
of the problems where it can help you:
Emails are delayed, or are not received.
Users receive NDRs which are difficult to interpret.
Messages are accumulating in one of the queues on the Exchange 2007
Mail Flow Troubleshooter will diagnoses the retrieved data, and even make
suggestions for cures to your NDR problems. You enter the symptoms
from a pick list, the Mail Flow Troubleshooter then employs built-in logic
to suggestion solutions.
ExBPA (Exchange Best Practice Analyzer) It may be a help, or the ExBPA may distract you from
troubleshooting NDRs. What the ExBPA
will do is provide a general health check for the Exchange 2007 server.
Check the Logs
Good technique is to begin by looking in the Application log for errors. A variation of this tip is to increase the
Check the queue and SMTP logs on the Exchange 2007 server.
Firewalls and Anti-virus software You may try turning off temporarily anti-virus software and even
the client-side firewall to see if that enables the email to get through.
PowerShell for Viewing Queues It may speed up troubleshooting your Exchange NDR if you use the PowerShell cmdlets, for
get-Message -queue <QueueID>
Note: Each cmdlet has switches or parameters, try: get-Help verb-noun to
find out more about an interesting cmdlet.
Regtrace You could also gather more clues about your Exchange NDR with Regtrace, which you find on the
Exchange 2003 CD in the support\utils\i386 folder. Regtrace gives you detailed information e.g. homeMDB = CN=Mailbox Store (JethroMail-Managers),CN=First Storage
Group,CN=InformationStore,CN=JethroMail-Managers,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=JethroMail,DC=com
Telnet Try telnet over port 25. Naturally, you need to substitute a
real Exchange 2007 server for 'YourServer'. Open a command prompt,
Monitor Your Network with the Real-time Traffic Analyzer
The main reason to monitor your network is to check that
your all your servers are available. If there is a network problem you
want an interface to show the scope of the problem at a glance.
Even when all servers and routers are available, sooner or later you will be curious to
know who, or what, is hogging your precious network's bandwidth. A GUI
showing the top 10 users makes interesting reading.
Another reason to monitor network traffic is to learn more about your
server's response times and the use of resources. To take the pain out of
capturing frames and analysing the raw data, Guy recommends that you download a copy of
free Real-time NetFlow Analyzer.
General Troubleshooting Advice for Exchange NDRs
One of the best approaches to troubleshooting is to keep asking
questions until you isolate the problem. In the case of an NDR,
discover if the fault lies with the Exchange 2007 server itself, the
sender, or the recipient. Here are ways of collecting more clues;
Send another email to the same recipient but using a different
If it's attachment, then try with no attachment.
If it's just one email address that produces the Non-delivery report,
what happens if you type the SMTP address manually, compared with when you click the user account in the GAL?
Alternatively, you could send emails to different recipients from
the original sender.
Is the the Exchange NDR random, or can you reproduce it easily?
Do you have multiple sites? If so are they all affected, or
If all else fails try sending an email to oneself!
Bear in mind that Microsoft Outlook has a 'Test Account Settings'
button to collect information from the client side.
My favoured non-delivery troubleshooting technique is to narrow the search area to a particular
server, mailstore or Routing Group Connector? However, if that
fails then I would expand the search area by sending email to different
sites, or to internet users.
I was initially annoyed because one particular ISP would only troubleshoot NDRs if
I used the Outlook Express client. At first I was
annoyed, but then I realized that you get different responses from
different email clients. Therefore my tip is, try a different version of
It is possible to disable NDR in Exchange. However, there is
more then one place to visit if you want to turn off NDRs in Exchange 2007
server. Log on as administrator, and navigate to the Exchange
Management Console. It makes most sense to start with the Hub
Transport node, remember this role is needed if you send emails to
recipients on the same server.
Disable NDR Exchange 2007 Hub Server
Launch the Exchange Management Console
Expand the Organization Configuration folder
Click on Hub Transport
Select Remote Domains (Key point)
Right-click Default (Tab)
Click on the Message Format (Tab)
To turn off NDR, remove the tick on Allow non-delivery reports.
(See NDR screenshot to the right)
Note: You can also control 'Allow delivery reports' on this tab.
These are the normal DSN delivery status notifications.
PowerShell commands to disable NDR in Exchange 2007
If you are experimenting with allowing, or disabling NDRs, then
this PowerShell cmdlet will be quicker.
Launch the Exchange Management Shell type:
set-RemoteDomain "Default" -NdrEnabled $false
Note 1: "Default" is the name of the Remote Domain setting where you
want to turn off NDR.
Note 2: To Allow non-delivery reports, change
set-RemoteDomain "Default" -NdrEnabled $false
set-RemoteDomain "Default" -NdrEnabled $true. This
places a tick in the checkbox. If you clear this option, NDRs aren't
sent to any email address in the remote domain.
Note 3: For more information about this, or any other PowerShell cmdlet,
precede the command with get-Help. For example: get-Help
Turn off NDR Exchange 2007 for Unified Messaging Role
This ability to control NDRs is particularly useful on servers with the
Unified Messaging Role.
Launch the Exchange Management Console
In the left tree, expand the Organization Configuration node
Click the Unified Messaging folder.
On the UM Dial Plans tab, select the UM dial plan that you want to
manage, and then select Properties.
From the General tab, check or clear the box next to 'Send a
non-delivery report if message delivery fails'.
There several reasons to turn off NDR in Exchange 2007; for example,
virus infections, spam infiltration or spoof attacks.
Note: there is no Badmail folder option in Exchange
2007, not even a registry hack. Instead badmail remains in the pickup
folder, you will spit the badmail by the .bad file extension.
Guy Recommends: SolarWinds' Free Bulk Mailbox Import Tool
Import users from a spreadsheet, complete with their mailbox. Just provide a list of the
users with the fields in the
top row, and save as .csv file. Then launch this FREE utility, match
your Exchange fields with AD's
attributes, click and import the users. Optionally, you can
provide the name of the OU where the new mailboxes will be born.
There are also two bonus tools in the free download, and all 3 have been approved by Microsoft:
Bulk-import new users and mailboxes into Active Directory.
There are many reasons for an NDR in Exchange 2007. If you examine an NDR carefully you will find
'Diagnostic Information for Administrators'. Within this message box is a status code number, for example
5.1.1. Two points arise from this
preliminary troubleshooting, firstly, there is more than one error code, and
secondly, a wide variety of possible causes. My aim is drill down into
the enhanced status code and
discover the reason why Exchange 2007 sends a particular NDR.
If you like this page then please share it with your friends
Here is a
free tool to monitor your Exchange Server.
Download the utility, then inspect your mail queues, monitor Exchange server's
memory, confirm there is enough disk space and check the CPU utilization.