Microsoft Exchange 2010 NDRs (Non-delivery Reports)
What causes NDRs? Let us take the case where an Outlook client sends an email to recipient on an Exchange 2010 server, however, that server calculates that it cannot deliver the message. What happens next? The answer is the ‘Generating Server’ sends a NDR back to the sender’s Outlook client.
At first, it came as a revelation when I discovered that there is more than one type of Exchange 2010 NDR. Then I discovered that NDRs have enhanced status codes. Furthermore, each code number gives extra information about the cause of the email delivery problem. This list will help you troubleshoot these NDR codes.
Topics for Exchange 2010 Non-delivery Reports
- Interpreting Your NDR in Exchange
- NDR (Non-delivery Report) Example
- List of Exchange 2010 NDR Codes and their Meanings
- Tools and Tips for Troubleshooting Exchange NDRs
- Summary – Exchange 2010 NDRs
♠
Interpreting Your Exchange NDR
Diagnostic Information for Administrators
When you examine the diagnostic information in a NDR message, make a note of the three-digit code, for example, 5.3.1. In Exchange 2010, these are known as ‘Common Enhanced Status Codes’.
When the first digit begins with 5, then it means you are dealing with a permanent error; this particular message will never be delivered. Occasionally, you get an Exchange NDR beginning with 4, in which case there is hope, the email may get through eventually.
NDR codes such as 5.5.0, or 4.3.1, may remind you of SMTP errors 550 and 431. Indeed, the 500 series in SMTP has a similar meaning to the 5.y.z codes in an NDR – failure. Perhaps you have worked out why there are no series 2.y.z Exchange 2010 NDRs? The reason being the 2.y.z family mean success, whereas Non-delivery Reports are all failures.
NDR Classification for Common Enhanced Status Codes
Clearly these status codes are not random numbers, we can detect patterns. The first number 4.y.z, or 5.y.z refers to the class of code, for example, 5.y.z is permanent error.
The second number x.1.z denotes the subject. This second digit, 1 in the previous example, gives generic information, whereas the third digit (z) gives detail. Unfortunately, I have not cracked the complete code for the second digit. However, I have discovered a few useful patterns, for instance, 5.1.x indicates a problem with the email address, as opposed to server or connection problem. In addition, 5.2.x means that the email is too big, therefore I recommend checking the message limit setting on your Exchange 2010 server.
Exchange Console Configuration – Allow Delivery Reports
If your mail queues are getting full of NDRs from the postmaster to possible spammers, then disable ‘Allow delivery reports’ on the Property sheet:
Hub Transport\Remote Domains\Default Properties\Allow delivery reports.
Problem: If you remove the tick then it will prevent valid NDRs being created.
Guy Recommends: A Free Trial of the Network Performance Monitor (NPM)
v11.5
SolarWinds’ Network Performance Monitor will help you discover what’s happening on your network. This utility will also guide you through troubleshooting; the dashboard will indicate whether the root cause is a broken link, faulty equipment or resource overload.
What I like best is the way NPM suggests solutions to network problems. Its also has the ability to monitor the health of individual VMware virtual machines. If you are interested in troubleshooting, and creating network maps, then I recommend that you try NPM now.
Download a free trial of SolarWinds’ Network Performance Monitor
NDR (Non-delivery Report) Example
Here below is an example of an email sent to a non-existent user. There is no eddie mailbox on the worcester server. In the body of the NDR, you can see the name of the domain (exchmike.com), the server (worcester) and the NDR status code (5.1.1). In your examples, always seek out the servername in the Received: from server (IP Address) of your NDR.
Your message did not reach some or all of the intended recipients.
Subject: Undeliverable: Secret
Sent: 02/03/2011 12:01 PM
Delivery has failed to these recipients:
[email protected] on 02/03/2011 12:01 PM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.
<worcester.exchmike.com #5.1.1>
List of Exchange 2010 NDR Codes and their Meanings
NDR | Explanation of Enhanced Status Codes in Exchange 2010 NDRs |
| 4.2.2 | The recipient has exceeded their mailbox limit. Alternatively it could mean that the delivery directory on the Virtual server has exceeded its limit. |
| 4.3.1 | Insufficient system resources. This normally translates to not enough disk space on the delivery server. Microsoft say this Exchange NDR may be reported as out-of-memory error. |
| 4.3.2 | A classic temporary problem. Most probably, the Exchange Administrator has frozen the queue. |
| 4.4.1 | Intermittent network connection. The server has not yet responded. A classic time-out problem. If it persists, you will also get a 5.4.x status code error. |
| 4.4.2 | The server started to deliver the message but then the connection was dropped. The sending server will retry automatically. |
| 4.4.6 | Too many hops. Most likely, the message is looping. |
| 4.4.7 | Problem with a protocol timeout, for example a message header limit. Check your receiving server connectors. |
| 4.4.9 | A DNS problem. Check your smart host setting on the SMTP connector. For example, check correct SMTP format. Also, use square brackets in the IP address [198.81.23.4] You can get this non-delivery error if you have been deleting routing groups. |
| 4.6.5 | Multi-language situation. Your server does not have the correct language code page installed. |
| 5.0.0 | SMTP 500 reply code means an unrecognised address. You get this NDR when you make a typing mistake, such as trying to send email via telnet. The most likely cause is a routing error. Another solution maybe to add an * in the address space. A separate cause for NDR 5.0.0 is a DNS problem. |
| |
| 5.1.x | Exchange 2010 NDR problems with email address. |
| 5.1.0 | Sender denied. NDR often seen with contacts. Verify the recipient address. Also Mismatched Network Card duplex setting. |
| 5.1.1 | Bad destination mailbox address. 5.1.1 is the most common Exchange 2010 NDR; there is a problem with the recipient address. Perhaps the recipient does not exist. Possibly the user was moved to another server in Active Directory. Check for mailbox delegation. Maybe an Outlook client replied to a message while offline. Check the Exchange connector configuration. |
| 5.1.2 | SMTP; 550 Host unknown. An error is triggered when the host name can’t be found. For example, when trying to send an email to bill@ nowheredomain.com. [Example kindly sent in by Paul T.] N.B. You can create custom DSN (Delivery Status Notification) messages for senders using PowerShell’s New-SystemMessage. |
| 5.1.3 | Invalid recipient address. Another problem often seen with contacts. Address field may be empty. Check the address information. Or there could be a syntax error. |
| 5.1.4 | Destination mailbox address ambiguous. Two objects have the same address, which confuses the Exchange 2010 Categorizer. |
| 5.1.5 | Destination mailbox address invalid. |
| 5.1.6 | Problem with homeMDB or msExchHomeServerName – check how many users are affected. Sometimes running RUS (Recipient Update Service) cures this problem. Mailbox may have moved. |
| 5.1.7 | Invalid address. Problem with senders mail attribute, check properties sheet in ADUC. |
| 5.1.8 | Something the matter with sender’s address |
| 5.2.x | NDR caused by the size of the email. |
| 5.2.1 | Mailbox cannot be accessed. Perhaps the message is too large. Alternatively, the mailbox has been disabled, or is offline. Check the recipient’s mailbox. Else it could be a permissions problem, particularly on a Public Folder. If so, try this PowerShell Command: get-PublicFolderClientPermission "\ProblemFolder" |
| 5.2.2 | Sadly, the recipient has exceeded their mailbox storage quota. |
| 5.2.3 | Recipient cannot receive messages this big. The server or connector limit exceeded. Try resending the message without the attachment. |
| 5.2.4 | Most likely, a distribution list or group is trying to send an email. Check where the expansion server is situated. The application event log may have an Event ID 6025 or 6026, which has more detailed information. |
| 5.3.0 | Problem with MTA, maybe someone has been editing the registry to disable the MTA / Store driver. |
| 5.3.1 | Mail system full. Disk full problem on the mailbox server? |
| 5.3.2 | System not accepting network messages. Look outside Exchange for a connectivity problem. |
| 5.3.3 | Remote server has insufficient disk space to hold email. Check SMTP log. This error often happens when the sending server is using an ESMTP BDAT command. |
| 5.3.4 | Message too big. Check the limits on both the sender and receiver side. There may be a policy in operation. |
| 5.3.5 | System incorrectly configured. Multiple Virtual Servers are using the same IP address and port. See Microsoft TechNet article: 321721 Sharing SMTP. Email probably looping. |
| 5.4.0 | DNS Problem. Check the Smart host, or check your DNS. It means that there is no DNS server that can resolve this email address. Could be Virtual Server SMTP address. |
| 5.4.1 | No answer from host. Not Exchange’s fault check connections. |
| 5.4.2 | Bad connection. |
| 5.4.3 | Routing server failure. No available route. |
| 5.4.4 | Cannot find the next hop, check the Routing Group Connector. Perhaps you have Exchange servers in different Routing Groups, but no connector. Configuring an MX record may help. |
| 5.4.6 | Tricky looping problem, a contact has the same email address as an Active Directory user. One user is probably using an Alternate Recipient with the same email address as a contact. Check recipient policy. |
| 5.4.7 | Delivery time-out. Message is taking too long to be delivered. |
| 5.4.8 | Microsoft advise, check your recipient policy. SMTP address should be yourdom.com. NOT server.yourdom.com. |
| 5.5.0 | Underlying SMTP 500 error. Our server tried ehlo, the recipient’s server did not understand and returned a 550 or 500 error. Set up SMTP logging. |
| 5.5.1 | Invalid command. (Rare Exchange NDR) |
| 5.5.2 | Possibly the disk holding the operating system is full. Alternatively, it could be a syntax error if you are executing SMTP from telnet. |
| 5.5.3 | Too many recipients. More than 5,000 recipients. Check the Global Settings, Message Delivery properties. Try resending the same message to fewer recipients. |
| 5.5.4 | Invalid domain name. The true cause may be an invalid character. |
| 5.5.5 | Wrong protocol version. |
| 5.5.6 | Invalid message content. This is a protocol error, thus you should get more information by looking in the application log. |
| 5.6.0 | Corrupt message content. Try sending without attachment. |
| 5.6.1 | Media not supported. |
| 5.6.3 | More than 250 attachments. |
| 5.7.1 | A very common Exchange 2010 NDR, the cause is a permissions problem. For some reason the sender is not allowed to email this account. Perhaps an anonymous user is trying to send mail to a distribution list. Alternatively, a user may have a manually created email address that does not match a System Policy. Check SMTP Virtual Server Access Tab. Try checking this box: Allow computers which successfully authenticate to relay. Check the outgoing SMTP logs. Check: Mailbox – <Mailboxname> – Properties – Mail Flow Settings – Message delivery restrictions. Try disabling Windows-Integrated-Security. Instead allow only standard authorization on the SMTP receiver on the Exchange 2010 server. Check Attachment filtering on the Edge server. |
| 5.7.2 | Distribution list cannot expand and so is unable to deliver its messages. |
| 5.7.3 | Not Authorized, security problem. It could be that the sender cannot send to the alternative address. On another tack, check external IP address of ISA server. Make sure it matches the SMTP publishing rule. |
| 5.7.4 | Extra security features not supported. Check delivery server settings |
| 5.7.5 | Cryptographic failure. Try a plain message with encryption. |
| 5.7.6 | Certificate problem, encryption level may be to high. |
| 5.7.7 | Message integrity problem. |
| See more on Exchange Non-delivery Reports. | |
Guy Recommends: The Free Config Generator
SolarWinds’ Config Generator is a free tool, which puts you in charge of controlling changes to network routers and other SNMP devices. Boost your network performance by activating network device features you’ve already paid for.
Guy says that for newbies the biggest benefit of this free tool is that it will provide the impetus for you to learn more about configuring the SNMP service with its ‘Traps’ and ‘Communities’. Try Config Generator now – it’s free!
Download your free copy of Config Generator
Tools and Tips for Troubleshooting Exchange NDRs
Exchange Mail Flow Tools
1) Launch the Exchange Management Console
2) Click on the Toolbox
3) Examine the Mail flow Tools
Alternatively:
Download the Microsoft Exchange Troubleshooting Assistant v1.1, one of its components is the Exchange Mail Flow Troubleshooter. Here are some of the problems where it can help you:
- Emails are delayed, or are not received.
- Users receive NDRs which are difficult to interpret.
- Messages are accumulating in one of the queues on the Exchange 2010 server.
Mail Flow Troubleshooter will diagnoses the retrieved data, and even make suggestions for cures to your NDR problems. You enter the symptoms from a pick list, the Mail Flow Troubleshooter then employs built-in logic to suggestion solutions.
ExBPA (Exchange Best Practice Analyzer)
It may be a help, or the ExBPA may distract you from troubleshooting NDRs. What the ExBPA will do is provide a general health check for the Exchange 2010 server.
Check the Logs
Good technique is to begin by looking in the Application log for errors. A variation of this tip is to increase the Diagnostic Logging.
Check the queue and SMTP logs on the Exchange 2010 server.
Firewalls and Anti-virus software
You may try turning off temporarily anti-virus software and even the client-side firewall to see if that enables the email to get through.
PowerShell for Viewing Queues
It may speed up troubleshooting your Exchange NDR if you use the PowerShell cmdlets, for example:
get-Queue <QueueId>
retry-Queue <xyz>
get-Message -queue <QueueID>
Note: Each cmdlet has switches or parameters, try: get-Help verb-noun to find out more about an interesting cmdlet.
Regtrace
You could also gather more clues about your Exchange NDR with Regtrace, which you find on the Exchange 2003 CD in the support\utils\i386 folder. Regtrace gives you detailed information e.g. homeMDB =
CN=Mailbox Store (JethroMail-Managers),CN=First Storage Group,CN=InformationStore,CN=JethroMail-Managers,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=JethroMail,DC=com
Telnet
Try telnet over port 25. Naturally, you need to substitute a real Exchange 2010 server for ‘YourServer’. Open a command prompt, type:
Telnet YourServer 25
Success means that the SMTP mail server is available. See here for help with Telnet troubleshooting.
Guy Recommends: SolarWinds Network Topology Mapper (NTM)
NTM will produce a neat diagram of your network topology. But that’s just the start;Network Topology Mapper can create an inventory of the hardware and software of your machines and network devices. Other neat features include dynamic update for when you add new devices to your network. I also love the ability to export the diagrams to Microsoft Visio.
Finally, Guy bets that if you test drive the Network Topology Mapper then you will find a device on your network that you had forgotten about, or someone else installed without you realizing!
Download your 14 day free trial ofSolarWinds Network Topology Mapper
General Troubleshooting Advice for Exchange NDRs
One of the best approaches to troubleshooting is to keep asking questions until you isolate the problem. In the case of an NDR, discover if the fault lies with the Exchange 2010 server itself, the sender, or the recipient. Here are ways of collecting more clues;
- Send another email to the same recipient but using a different sender.
- If it’s attachment, then try with no attachment.
- If it’s just one email address that produces the Non-delivery report, what happens if you type the SMTP address manually, compared with when you click the user account in the GAL?
- Alternatively, you could send emails to different recipients from the original sender.
- Is the the Exchange NDR random, or can you reproduce it easily?
- Do you have multiple sites? If so are they all affected, or just one?
- If all else fails try sending an email to oneself!
- Bear in mind that Microsoft Outlook has a ‘Test Account Settings’ button to collect information from the client side.
- Check the logs (mentioned in the tools section).
My favoured non-delivery troubleshooting technique is to narrow the search area to a particular server, mailstore or Routing Group Connector? However, if that fails then I would expand the search area by sending email to different sites, or to internet users.
I was initially annoyed because one particular ISP would only troubleshoot NDRs if I used the Outlook Express client. At first I was annoyed, but then I realized that you get different responses from different email clients. Therefore my tip is, try a different version of Microsoft Outlook.
PowerShell commands to disable NDR in Exchange 2010
If you are experimenting with allowing, or disabling NDRs, then this PowerShell cmdlet will be quicker.
Launch the Exchange Management Shell type:
Set-RemoteDomain "Default" -NdrEnabled $false
Note 1: "Default" is the name of the Remote Domain setting where you want to turn off NDR.
Note 2: To Allow non-delivery reports, change
Set-RemoteDomain "Default" -NdrEnabled $false
to
Set-RemoteDomain "Default" -NdrEnabled $true. This places a tick in the checkbox. If you clear this option, NDRs aren’t sent to any email address in the remote domain.
Note 3: For more information about precede the command with Get-Help. For example:
Get-Help set-RemoteDomain.
See more about Exchange 2010 Powershell
Guy Recommends: Free WMI Monitor for PowerShell
Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft’s operating systems. Fortunately, SolarWinds have created a Free WMI Monitor so that you can discover these gems of performance information, and thus improve your PowerShell scripts.
Take the guess work out of which WMI counters to use when scripting the operating system, Active Directory, or Exchange Server. Give this WMI monitor a try – it’s free.
Download your free copy of WMI Monitor
Turn off NDR Exchange 2010 for Unified Messaging Role
This ability to control NDRs is particularly useful on servers with the Unified Messaging Role.
- Launch the Exchange Management Console
- In the left tree, expand the Organization Configuration node
- Click the Unified Messaging folder.
- On the UM Dial Plans tab, select the UM dial plan that you want to manage, and then select Properties.
- From the General tab, check or clear the box next to ‘Send a non-delivery report if message delivery fails’.
There several reasons to turn off NDR in Exchange 2010; for example, virus infections, spam infiltration or spoof attacks.
Note: there is no Badmail folder option in Exchange 2010, not even a registry hack. Instead badmail remains in the pickup folder, you will spit the badmail by the .bad file extension.
Summary- Microsoft Exchange Server 2010 NDRs
There are many reasons for an NDR in Exchange 2010. If you examine an NDR carefully you will find ‘Diagnostic Information for Administrators’. Within this message box is a status code number, for example 5.1.1. Two points arise from this preliminary troubleshooting, firstly, there is more than one error code, and secondly, a wide variety of possible causes. My aim is drill down into the enhanced status code and discover the reason why Exchange 2010 sends a particular NDR.
If you like this page then please share it with your friends
See more Microsoft Exchange Server 2010 topics:
• Exchange 2010 Home • Exchange 2010 Transition • Exchange 2010 Migration • Exchange Stores
• Server Roles • Office 365 Migration • Exchange 2010 Performance Monitor • Eseutil Commands
• Exchange 2010 NDR • Exchange 2010 GAL • Exchange OWA 2010 • Exchange 2010 New Features
