Home / server / Questions / 96257
In Process
Marko Carter
Asked: 2009-12-22 02:50:42 +0800 CST

Exchange 2003 Delvery Status EMail - URGENT!

  • 772

I got a page last night that the mailbox store has dismounted. I've sorted that but now I have 85000 emails in my in box and 800 more arriving every minute - Delivery Status Notification (Delayed).

Haven't a clue on this - help!

exchange

2 Answers

  1. Delayed messages are a normal part of exchange message delivery and are just status updates. You should be able to delete these safely. It sounds like the company you're working for sends a lot of emails, so you'll get one of these notifications for every message that was sent while the store was offline

    • 2

  2. I think there's something else going on here. Unless there were a large number of outbound messages in the queue prior to the store unmounting how would users have sent messages if the store was unmounted? None of the Exchange clients (Outlook, OWA, etc.) would have been able to connect to their mailboxes if the store was down and therefore couldn't have sent any new messages. Even so, 85,000 DSN's sounds like someone is using the server as a relay and these DSN's are for failed spam emails going out from your server. Furthermore, the DSN Delayed messages are for outbound messages from your server, do you really believe that these DSN's are for 85,000 legitimate outbound messages? It sounds pretty fishy to me. Have you looked at any of them? Are they for recipients\domains that your users normally send to? Are any of them for foreign recipients (.uk, .de, etc.)? Do you have any external users who connect via authenticated SMTP? Have you checked your network for malware?

    My recommendation at this point is to freeze the queues and start looking deeper at these DSN's. This article should get you going in the right direction:

    http://www.amset.info/exchange/spam-cleanup.asp

    • 1