Delivery Status Notification email looping, but exchange not the cause.

Discussion in 'Computer Support' started by Jazz, Jan 4, 2007.

  1. Jazz

    Jazz Guest

    Exchange 5.5 SP4 on one machine, GFI MailEssentials and MailSecurity on

    seperate server, for filtering.

    I work for a K - 12 school and the network admin (and the admin for
    pretty much anything else associated with a computer).

    We recently had out xmas break. One teacher set up her out of office

    A spam got through our GFI MailEssentials filtering server with a fake
    return address. Her OOOA replied to it and forwarded the spam to her
    personal account. Since the spam return email addy was fake, she was
    sent a NDR email... at which point the infinite loop started... since
    our xmas break is about 3 weeks long, you can guess what happened.

    I arrive a day before school started back, deleted her 14,000+ emails,
    and disabled her out of office assistant.

    I downloaded and installed KB837794 that tells exchange not to even
    generate NDRs anymore. My GFI modules dont create any either (didnt to
    begin with.)

    I went so far as to disable her mail account (she didnt mind, doesnt
    miss getting emails). I have a program on my GFI server that allows me
    to monitor incoming and outgoing mail. Not read it, but see who it is
    from, the subject, who it is to, and if it was processed ok (called
    "GFI content security monitor"). This sucker was processing about 4
    NDRs per second for this user. All saying (with a date and time stamp
    for each):

    "Processing new item.
    Subject: Delivery Status Notification (Failure) or (Delay)
    Sender: <>
    Recipient to: (my users email address)
    Item processed ok"

    Needless to say, this bogs my GFI server down. Meaning some emails are
    4 hours late, sometimes 10 hours late, and some just dont come in at
    all (or go out), giving the sender a bounced back email.

    Funny thing is that yesterday and today I thought my troubles were
    over. The info above was no longer flowing through my GFI monitor.
    NORMAL emails were coming in and going out. This went on for about 6 or

    7 hours. Then, the looping came back.

    I have contacted GFI tech support and their only suggestion is for me
    to sit and "ride it out" until GFI is done processing those 3 weeks
    work of NDRs. Since i have disabled her OOOA, it shouldnt be creating
    any new ones, just processing old ones....

    But the 6 to 7 hour "break" it takes baffles me... heck, the whole darn

    situation baffles me because i feel like i can do NOTHING!

    I guess my question is... do I, in fact, just have to sit and wait it

    Thanks in advance....
    Jazz Mann
    Jazz, Jan 4, 2007
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. winman
    Jul 30, 2003
  2. jayjwa

    Yet Another IE Vulnerability??- Frame Looping

    jayjwa, Nov 12, 2003, in forum: Computer Security
    Nov 13, 2003
  3. stephen
    Oct 1, 2006
  4. Mark
  5. Elainie
    Jan 22, 2007