I have a user who cannot receive a message from a particular external sender. That senders assistant (same domain and server as the external sender with the issue) is able to forward the exact same message to my user and it arrives as it should. In message tracking, I can see the message came in through my smart host, through my front end and to the users mailbox server, where an NDR was generated. We had the assistant forward us the NDR and it says:
There's a problem with the recipient's mailbox. Please try resending this message. If the problem continues, please contact your helpdesk.
From my 3rd party smart host/spam filter, I have a copy of the message in audit and when I forward it to myself, the same thing happens - it generates an NDR when it arrives at my Exchange mailbox server. This makes me conclude that my end users mailbox isn't corrupt, rather it's something in the message header that our server doesn't like (I've seen this happen with other senders as well, but it is extremely rare and random).
Details/facts of my environment:
-Current production messaging system is Exchange 2003.
-Working on Exchange 2010 co-existence.
-This problem between this sender and us has been an issue before the introduction of Exchange 2010.
-I'm hoping to begin end user mailbox migrations to 2010 and will have the sender try again at that time, but I still have testing to do with our voice messaging system before I can begin moving end user mailboxes.
....Begin redacted NDR detail....
Remote Server returned '< #5.2.1>'
Original message headers:
Received: from fe.mydomain.com ([192.168.1.10]) by
mailboxsrv.mydomain.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 4 Sep
2014 12:49:48 -0700
Received: from exc2010.mydomain.com ([192.168.1.50]) by
fe.mydomain.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 4 Sep
2014 12:49:47 -0700
Received: from smtp.mydomain.com (192.168.1.49) by exch2010.mydomain.com
(192.168.1.50) with Microsoft SMTP Server (TLS) id 14.3.210.2; Thu, 4 Sep 2014
12:49:47 -0700
Received: from pps.filterd (PPMail.mydomain.com [127.0.0.1]) by
PPMail.gsblaw.com (8.14.5/8.14.5) with SMTP id s84Jkb0n023682 for
<myuser@mydomain.com>; Thu, 4 Sep 2014 12:49:47 -0700
Received: from na01-by2-obe.outbound.protection.outlook.com
(mail-by2on0098.outbound.protection.outlook.com [TheirIP]) by
PPMail.gsblaw.com with ESMTP id 1p6da7h0jw-1 (version=TLSv1/SSLv3
cipher=AES256-SHA bits=256 verify=NOT) for <Myuser@mydomain.com>; Thu, 04 Sep
2014 12:49:42 -0700
Received: from Theirexchange.theirdomain.com (TheirinternalIP) by
Theirexchange.theirdomain.com (TheirinternalIP) with Microsoft SMTP
Server (TLS) id 15.0.1019.16; Thu, 4 Sep 2014 19:49:38 +0000
Received: from Theirexchange.theirdomain.com ([10.141.86.14]) by
Theirexchange.theirdomain.com ([TheirinternalIP]) with mapi id
15.00.1019.015; Thu, 4 Sep 2014 19:49:38 +0000
Content-Type: multipart/mixed;
boundary="_000_9a166afd24964edda2d5439ba3dbe712DM2PR08MB445namprd08pro_"
From: Mr Sender <sender@theirdomain.com>
To: My User <myuser@mydomain.com>, "Another external recipient (someoneelse@anotherdomain.us)"
<mike@vinco.us>
Subject: FW: A Subject
Thread-Topic: A Subject
Thread-Index: Ac/C2zn97ruwXQpoQtGNrjKOr1NckgFmNoeAAAEpQ2A=
Date: Thu, 4 Sep 2014 19:49:37 +0000
Message-ID: <9a166afd24964edda2d5439ba3dbe712@DM2PR08MB445.theirexchange.theirdomain.com>
References: <3340b0a848f04e3bbb488b4eda93d54e@DM2PR08MB445.theirexchange.theirdomain.com>
<83FC8FC0E8B91C4594608EA214C0BBAD54BBB844@S1P5DAG8C.EXCHPROD.USA.NET>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <9a166afd24964edda2d5439ba3dbe712@DM2PR08MB445.theirexchange.theirdomain.com>
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [internetIP]
x-microsoft-antispam: BCL:0;PCL:0;RULEID:;UriScan:;
x-forefront-prvs: 0324C2C0E2
x-forefront-antispam-report: SFV:NSPM;SFS:(10009015)(6009001)(189002)(199003)(377454003)(164054003)(64706001)(66066001)(19609705001)(15202345003)(50986999)(19300405004)(19625215002)(90102001)(80022001)(20776003)(83322001)(101416001)(99936001)(76176999)(54356999)(81542001)(21056001)(19580395003)(86362001)(4396001)(92566001)(16236675004)(85852003)(551944002)(74502001)(83072002)(87936001)(74662001)(31966008)(107886001)(81342001)(76482001)(46102001)(85306004)(105586002)(33646002)(15975445006)(99396002)(76576001)(74316001)(77982001)(79102001)(95666004)(108616004)(2656002)(106356001)(99286002)(24736002);DIR:OUT;SFP:1101;SCL:1;SRVR:DM2PR08MB446;H:DM2PR08MB445.namprd08.prod.outlook.com;FPR:;MLV:sfv;PTR:InfoNoRecords;MX:1;A:1;LANG:en;
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.12.52,1.0.27,0.0.0000
definitions=2014-09-04_03:2014-09-04,2014-09-04,1970-01-01 signatures=0
X-Proofpoint-Spam-Reason: safe
Return-Path: sender@theirdomain.com
X-OriginalArrivalTime: 04 Sep 2014 19:49:47.0046 (UTC) FILETIME=[61900460:01CFC879]