Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I got a page last night that the mailbox store has dismounted. I've sorted that but now I have 85000 emails in my in box and 800 more arriving every minute - Delivery Status Notification (Delayed).

Haven't a clue on this - help!

share|improve this question

2 Answers 2

Delayed messages are a normal part of exchange message delivery and are just status updates. You should be able to delete these safely. It sounds like the company you're working for sends a lot of emails, so you'll get one of these notifications for every message that was sent while the store was offline

share|improve this answer

I think there's something else going on here. Unless there were a large number of outbound messages in the queue prior to the store unmounting how would users have sent messages if the store was unmounted? None of the Exchange clients (Outlook, OWA, etc.) would have been able to connect to their mailboxes if the store was down and therefore couldn't have sent any new messages. Even so, 85,000 DSN's sounds like someone is using the server as a relay and these DSN's are for failed spam emails going out from your server. Furthermore, the DSN Delayed messages are for outbound messages from your server, do you really believe that these DSN's are for 85,000 legitimate outbound messages? It sounds pretty fishy to me. Have you looked at any of them? Are they for recipients\domains that your users normally send to? Are any of them for foreign recipients (.uk, .de, etc.)? Do you have any external users who connect via authenticated SMTP? Have you checked your network for malware?

My recommendation at this point is to freeze the queues and start looking deeper at these DSN's. This article should get you going in the right direction:

http://www.amset.info/exchange/spam-cleanup.asp

share|improve this answer
    
To expound on my answer: While DSN's are a normal part of Exchange operations, 85,000 DSN's in the queues and more coming in at a rate of 800 per minute is not normal behavior. As far as I'm concerned, your server has been compromised, either because it's an open relay or because one of the Exchange clients is infected with some type of malware. –  joeqwerty Jan 21 '10 at 2:36
    
Hi, it turned out it was a bad configuration between the Exchange box and our BES! –  Marko Carter Jan 21 '10 at 9:47
    
Wow, that's some kind of bad configuration. What was generating all the emails that generated all the DSN's? –  joeqwerty Jan 21 '10 at 12:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.