Member Avatar for ingrammusic

Does anybody know how to tell if email from outside my network made it to my exchange 2003 server?

I have a user that can't receive email from anyone on the outside unless it's a reply message from one the user sent.

Thanks

  • 1 Contributor
  • 1 Reply
  • 200 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by ingrammusic

Dani AI

Generated

Good find, — since a server-side spam agent is removing inbound messages before they reach the mailbox, the next steps are to gather reproducible evidence and isolate which component is making the decision rather than guessing at causes.

  • Confirm the filter action is set to quarantine (not delete) so copies of suspect messages are preserved for inspection.
  • Send identical test messages (same subject/body) to the affected mailbox and to a known-good mailbox; record date/time and Message-ID.
  • Correlate those timestamps in message-tracking, SMTP protocol logs and the anti-spam/quarantine store to find the exact point the message is dropped and the score assigned.
  • Inspect the affected mailbox object for delivery restrictions (for example, "require sender authentication" or allow/deny lists) and look for server-side mailbox rules or event sinks that could act differently per account.
  • Check for other anti-spam/antivirus agents or transport-level add-ins on the server that might run in a different order for different recipients. If available, temporarily whitelist the test sender/domain to confirm the filter is the culprit.

Compare the delivered and deleted samples side-by-side: headers, authentication results (SPF/SenderID or obvious HELO/PTR errors), attachments, and any quoted text. Spam scores often change dramatically with small content differences; that explains why a reply (which adds quoted text and threading headers) sometimes gets through while a fresh inbound message is blocked.

Preserve evidence before changing production settings. Quarantine-first, then adjust thresholds or add targeted whitelists. If identical messages have the same path and score but one mailbox still loses mail, the problem is likely a per-mailbox delivery restriction or a mailbox-level sink; those are the safest places to look next.

Member Avatar for ingrammusic

Found it.

Message tracking in the Exchange System Manager. Search for the sender. Turns out that IMF was deleting the messages before they went to the users mailbox. Now I just have to figure out why I can send an email to that user and IMF will delete it, but another user on the same exchange server will receive it??

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.