0

I have an on-site Exchange Server 2013 environment.

We use sendgrid for outgoing e-mail delivery.

I was just browsing through our sendgrid account (I don’t do that often), and I noticed a LOT of “deferred” emails in the activity feed. More concerning is that so many of them appear to be bogus or BS emails.

Any idea on how I can start backtracking the source of these emails?

It seems somewhere my system is compromised, but it could be the sendgrid account, or the Exchange server, or perhaps an individual e-mail client/PC.

Here is a small example of the email addresses I’m seeing in the “Deferred” queue (note that this is a professional organization that has nothing to do with any of these keywords):

Deferred   [email protected]   May 18, 2016 12:54:43 AM  
Deferred   [email protected]   May 18, 2016 12:49:36 AM  
Deferred   [email protected]   May 18, 2016 12:35:00 AM  
Deferred   [email protected]   May 18, 2016 12:32:46 AM  
Deferred   [email protected]   May 18, 2016 12:26:42 AM  
Deferred   [email protected]   May 17, 2016 11:52:18 PM  
Deferred   [email protected]   May 17, 2016 11:42:39 PM  
Deferred   [email protected]   May 17, 2016 11:34:55 PM
Deferred   [email protected]   May 17, 2016 11:31:57 PM  
Deferred   [email protected]   May 17, 2016 11:14:14 PM  
Deferred   [email protected]   May 17, 2016 10:43:05 PM  
Deferred   [email protected]   May 17, 2016 10:30:28 PM  
Deferred   [email protected]   May 17, 2016 10:29:58 PM  
Deferred   [email protected]   May 17, 2016 10:17:30 PM 
2
  • 1
    Have you checked your Exchange SMTP logs to see if any of these show up there? May 18, 2016 at 13:30
  • Additionally, have you checked your SendGrid IP Access Logs to see if unknown IPs are accessing your account? May 18, 2016 at 18:01

2 Answers 2

1

Have you check if these aren't just non-delivery notices sent in responses from spam that was sent to invalid internal email addresses ?

0

I'd bet that these are NDRs send by Exchange. Its common practice to disable such messages. In order to do so follow these resources:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .