Questions[ndr](server)

We have a service that we offer to one of our clients that sends statements to their clients. Unfortunately, our customer's validation of email addresses isn't always the best, so when they submit a batch to us to send we usually see a lot of emails that fail to send due to misspellings of common domains (ex. gnail.com, htmail.com, etc.). We collect the bounce backs to give to our client to fix their email list, but until that bounce back/NDR occurs, these messages remain in our postfix mailq until they reach the queue expiry time. Retrying to send again and again.

Is there any good way to have postfix send an NDR for these messages immediately on the first failure instead of trying again and again? We only want this to happen to bad domains though, sometimes, we see messages deferred due to greylisting, and they go out on the second attempt.

I have tried out my Google-foo, but it seems to be failing me in this task...

Recently, senders from Hotmail have begun to get the following NDR when trying to e-mail our domain.

EDIT : Full NDR Message

Action: failed Status: 5.5.0 Diagnostic-Code: smtp;550-Please turn on SMTP Authentication in your mail client, or login to the 550-IMAP/POP3 server before sending your message. 550-snt0-omc3-s36.snt0.hotmail.com [65.55.90.175]:49271 is not permitted to 550 relay through this server without authentication

This is seemingly out of the blue and I'm at a loss as to why this is happening.

Pertinent Information

• We have multiple domains hooked up to our Exchange server. We changed our company name in January of this year, and the old primary domain (olddomain.com) will accept e-mails from Hotmail accounts, however e-mails sent to the new primary domain (newdomain.com) bounce back with the NDR listed above.
• The bounces only appear to be happening when the Hotmail sender is sending a new e-mail, and not if they are responding to an e-mail sent from our end.
• We have made no changes to the configuration of our server recently. This e-mail first appeared last Friday.
• As far as I can tell, the mail doesn't even seem to get to our server
• We performed an Exchange 2003 to 2010 migration last year. The 2003 acts as a Smart Host

Any advice on this issue would be greatly appreciated! I'm at a loss

We recently discovered that one of our mailboxes was missing an important email alias, because the person that did our marketing forgot to ask for it to be created.

Is there any way in Exchange that we can track any emails that may have been sent to an un-known alias? They all received a 550 5.1.1 User Unknown NDR.

I don't expect to know what the content of the email is, but even just the number of requests would be great.

How do I completely disable NDR messages in Exchange 2003? I don't want Exchange to send any non delivery reports anymore.

I did already:

From Exchange System Manager, Global Settings, Internet Message Format. 
Right click > properties. Advanced tab. Uncheck Allow non-delivery reports.

And restarted Exchange, however this didn't fix it.

Windows Server 2003 Small Business Server SP2
Exchange Version 6.5 (Build 7638.2: Service Pack 2)

This network has been neglected and has been having email problems for years and was on many blacklists. I was called in after the server eventually crashed... I got the server back up and running, but email problems persist.

Outgoing mail delivery is sporadic. Sometimes the mail goes through, sometimes a delayed delivery report is generated after a day or more, and sometimes it seems to go through, but the recipient never receives it.

Not sure if spammers are successfully using the server as a relay (see event entries below after turning on maximum SMTP logging)...

• User PCs infected with viruses and server was blacklisted on many sites (I used mxtoolbox.com)
• I have cleaned all the PCs and changed all passwords (including administrator)
• I have requested removal from all of the blacklists - most have removed the listing, some take more time.

• I have setup rDNS pointer records with the ISP (Comcast) - that was one reason for some of the blacklistings.

• I have tested that it's not an open relay using telnet as described here:
  www.amset.info/exchange/smtp-openrelay.asp

• I followed the advise of a Spamhaus & Microsoft article to enable maximum SMTP logging. http://www.spamhaus.org/faq/answers.lasso?section=isp%20spam%20issues#320
  which directed me to Microsoft KB article 895853, specifically, the part 2/3 down titled:
  "If mail relay occurs from an account on an Exchange computer that is not configured as an open relay" .

The Application Event Log is filling with this type of activity (Event ID 7002, 7002 & 3018 errors):

Event Type: Error
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7004
Date: 1/18/2011
Time: 7:33:29 AM
User: N/A
Computer: SERVER
Description:
This is an SMTP protocol error log for virtual server ID 1, connection #621. The remote host "212.52.84.180", responded to the SMTP command "rcpt" with "550 #5.1.0 Address rejected [email protected] ". The full command sent was "RCPT TO: ". This will probably cause the connection to fail.

and this:

Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7002
Date: 1/18/2011
Time: 7:33:29 AM
User: N/A
Computer: SERVER
Description:
This is an SMTP protocol warning log for virtual server ID 1, connection #620. The remote host "212.52.84.170", responded to the SMTP command "rcpt" with "452 Too many recipients received this hour ". The full command sent was "RCPT TO: ". This may cause the connection to fail.

or a variant of:

Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7002
Date: 1/18/2011
Time: 8:39:21 AM
User: N/A
Computer: SERVER
Description:
This is an SMTP protocol warning log for virtual server ID 1, connection #661. The remote host "82.57.200.133", responded to the SMTP command "rcpt" with "421 Service not available - too busy ". The full command sent was "RCPT TO: ". This may cause the connection to fail.

also

Event Type: Error
Event Source: MSExchangeTransport
Event Category: NDR
Event ID: 3018 Date: 1/18/2011
Time: 9:49:37 AM
User: N/A
Computer: SERVER
Description:
A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;[email protected] (Message-ID ).
Causes: This message indicates a DNS problem or an IP address configuration problem
Solution: Check the DNS using nslookup or dnsq. Verify the IP address is in IPv4 literal format.
Data:
0000: ef 02 04 c0 ï..À

Any guidance and/or suggestions and/or tests to perform would be greatly appreciated.