Exchange Current Sessions and Mail Not Delivered

Hi there.

I see a domain listed in Current Sessions numerous times and then when I
refresh it goes away. But we are not receiving any mail from that domain
that shows up in Current Sessions.

Also, some domains we send to receive the mail 5 - 10 times.

HELP!!!

Thanks
Paddy

kimberj
Fri Oct 24 10:28:17 CDT 2003

Hi Paddy,

The current sessions are there for incoming and outgoing mail. If you are
not sending mail to that specific domain it is possible that someone is
attempting to send mail to your server to a user that does not exisit (ie
spam, junkmail). Exchange will send out a non-delivery report back to that
domain - this will create a current session.

When you are sending mail to the domains and they receive multple copies
are you sending to a distribution list? Are they always getting multiple
messages or does it happen only occationally? How are they downloading
mail - through POP3 connector?

Best Regards,

Kim Johnson, MCSE 2000
Microsoft Platform Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Paddy
Fri Oct 24 17:31:22 CDT 2003

Hi Kim,

thanks for your helpful reply.

The sessions that are showing up in Current Sessions that I know are not
correctly delivering mail are from Authorize.Net.
It regularly shows up listed numerous times as:

User From Connected Time
anetrelay2f-ext.authorize.net 64.94.119.18 127 seconds

but I am not receiving the merchant email receipts in my inbox even though I
know authorize.net are sending them because they are also arriving at my
yahoo account. It started happening like this all of a sudden on Monday
afternoon when we stopped receiving the emails from authorize.net. Then a
number of people at earthlink reported to us that they were receiving the
same emails up to 15 times for each one.

In the SMTP queues it shows both earthlink.net and compuserve.com with
active connections all the time. I know that when I send stuff to myself at
earthlink they often take a very long time to get there. The people who
are getting them 15 times are using a pop3 connector as far as I know. I.e.
I am pretty sure they are all using Outlook Express.

I am also noticing a long delay sometimes for email coming from Yahoo as
well. It is all very screwy and I can't put my finger on anything.

Any suggeststions would be great.

I'll just cut and paste what else I posted to other newsgroups (with no
reply) below here:

Hello,

Our Exchange Server suddenly stopped receiving emails from a particular
email address. This address is not filtered in any way on our server.
Additionally, I can actually see that server connecting to ours in the SMTP
Current Sessions but no mail acutally gets delivered. I turned on logging
to see if I could see what was happening and the results, for that domain
(anetrelay2f-ext.authorize.net),
are below:

17:14:10 64.94.119.18 HELO - 250
17:14:10 64.94.119.18 HELO - 250
17:16:44 64.94.119.18 QUIT - 0
17:16:44 64.94.119.18 QUIT - 0


Additionally, any email we send to earthlink takes a long time to get there
and when it does arrive it tends to be delivered anywhere from 3 - 12 times.

I have ensured that Relaying is not enabled. I have also made sure that the
SMTP is configured so that only the "list below" can relay and there is
nothing in the list below and the checkbox to allow authenticated people to
relay regarless of this is unchecked, i.e. if you are not on the list you
cannot relay regardless of if you can authenticate.

I am at a loss to resolve either of these problems.

Hoping someone can help.

Thanks
Paddy.

p.s here is an output of netstat -an : find ":25"

TCP 0.0.0.0:25 0.0.0.0:0 LISTENING
TCP 10.0.0.100:25 64.94.119.17:3101 ESTABLISHED
TCP 10.0.0.100:25 64.94.119.18:2621 ESTABLISHED
TCP 10.0.0.100:25 64.94.119.18:2622 ESTABLISHED
TCP 10.0.0.100:25 64.94.119.18:2626 ESTABLISHED
TCP 10.0.0.100:25 65.65.198.73:2482 ESTABLISHED
TCP 10.0.0.100:25 65.65.198.73:2602 ESTABLISHED
TCP 10.0.0.100:25 65.65.198.73:2822 ESTABLISHED
TCP 10.0.0.100:25 65.65.198.73:2921 ESTABLISHED
TCP 10.0.0.100:25 203.7.198.1:56991 ESTABLISHED
TCP 10.0.0.100:18887 149.174.40.140:25 ESTABLISHED
TCP 10.0.0.100:18925 207.217.120.23:25 ESTABLISHED
TCP 10.0.0.100:18996 207.136.229.14:25 TIME_WAIT
UDP 127.0.0.1:2567 *:*
UDP 127.0.0.1:2568 *:*
UDP 10.0.0.100:2535 *:*



Here is a dump of some of the log. There are a bunch of computer names that
just say things like "Computer" etc. which look a bit worrisome too.
21:12:35 - - - 0
21:12:35 cockatoo EHLO - 0
21:12:35 cockatoo - - 0
21:12:35 cockatoo MAIL - 0
21:12:35 cockatoo - - 0
21:12:35 cockatoo RCPT - 0
21:12:35 cockatoo - - 0
21:12:35 cockatoo DATA - 0
21:12:35 cockatoo - - 0
21:13:00 64.94.119.17 QUIT - 0
21:13:00 156.77.105.107 EHLO - 250
21:13:00 156.77.105.107 MAIL - 250
21:13:00 156.77.105.107 RCPT - 250
21:13:01 156.77.105.107 DATA - 250
21:13:01 156.77.105.107 QUIT - 0
21:13:45 206.169.96.171 EHLO - 250
21:13:45 206.169.96.171 MAIL - 250
21:13:45 206.169.96.171 RCPT - 250
21:13:45 206.169.96.171 DATA - 250
21:14:32 24.71.223.10 EHLO - 250
21:14:32 24.71.223.10 MAIL - 250



"Kim Johnson (MSFT)" <kimberj@online.microsoft.com> wrote in message
news:XFeg2NkmDHA.576@cpmsftngxa06.phx.gbl...
> Hi Paddy,
>
> The current sessions are there for incoming and outgoing mail. If you are
> not sending mail to that specific domain it is possible that someone is
> attempting to send mail to your server to a user that does not exisit (ie
> spam, junkmail). Exchange will send out a non-delivery report back to
that
> domain - this will create a current session.
>
> When you are sending mail to the domains and they receive multple copies
> are you sending to a distribution list? Are they always getting multiple
> messages or does it happen only occationally? How are they downloading
> mail - through POP3 connector?
>
> Best Regards,
>
> Kim Johnson, MCSE 2000
> Microsoft Platform Support
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
> When responding to posts, please "Reply to Group" via
> your newsreader so that others may learn and benefit
> from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
>
>

Paddy
Fri Oct 24 18:25:32 CDT 2003

Hi there.
Do these problems make sense if our ISP is experiencing similar problems
with their own email? I hear that their provider has some big routing
problems. So even though I can see some of these domain email servers
connecting to my server, if the connection is faulty then it can't deliver
the mail?




"Kim Johnson (MSFT)" <kimberj@online.microsoft.com> wrote in message
news:XFeg2NkmDHA.576@cpmsftngxa06.phx.gbl...
> Hi Paddy,
>
> The current sessions are there for incoming and outgoing mail. If you are
> not sending mail to that specific domain it is possible that someone is
> attempting to send mail to your server to a user that does not exisit (ie
> spam, junkmail). Exchange will send out a non-delivery report back to
that
> domain - this will create a current session.
>
> When you are sending mail to the domains and they receive multple copies
> are you sending to a distribution list? Are they always getting multiple
> messages or does it happen only occationally? How are they downloading
> mail - through POP3 connector?
>
> Best Regards,
>
> Kim Johnson, MCSE 2000
> Microsoft Platform Support
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
> When responding to posts, please "Reply to Group" via
> your newsreader so that others may learn and benefit
> from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
>
>

kimberj
Tue Oct 28 09:43:42 CST 2003

Hi Paddy,

If the clients are using POP3 to download their mail from an Exchange
Server it may deliver multiple copies if the Exchange server was down for a
time:

290043 OL2002: Outlook Downloads Duplicate POP3 Messages After Exchange
Server
http://support.microsoft.com/?id=290043

Are you forwarding all mail to a host or usinf DNS to send mail out in the
Exchange SMTP connector? If it is forwarding to host and the ISP has also
been experiencing problems that may be the cause for multiple mails.

As for the incoming mail from authorize.net - can you do any message
tracking on mail from the account they are sending from - This will tell us
if the mail hits the Exchange database and gets misrouted in some way.

Also can you setup for an account to receive notification that a non
deliver report has been sent out? To do so go to the SMTP virtual server
properties and on the Messages tab type the administrator mail address.
Message tracking may also help here to see if your Exchange server is
sending out the message multiple times.

246856 XADM: How to Enable Message Tracking in Exchange 2000 Server
http://support.microsoft.com/?id=246856

Is the POP3 connector configured on the server? If you are getting the
mail via SMTP the POP3 connector settings should be empty.

Best Regards,

Kim Johnson, MCSE 2000
Microsoft Platform Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.