MSExchangeGuru.com

A problem e-mail administrators face is users setting up wrong forwarding rules in their mailboxes to e-mail addresses that either doesn’t exist (this happens to me a lot!) or to mailboxes that are full and not accepting new e-mails.

Whenever an e-mail is sent to these users, it gets forwarded automatically by the rule in place to that non-existing address which generates a Non-Delivery Receipt (NDR). When this NDR is received, it gets forwarded to the same address again, which generates another NDR, and so on, and so on, going into an infinite loop. This is known as an NDR Storm.

Internally, Microsoft Exchange is able to detect this and automatically stops it. However, with e-mails coming from outside the organization, this is not the case due to multiple reasons…

What is an NDR?

An NDR is a message that a mail server sends to notify the sender when a problem occurs with the delivery of the e-mail. For example if the server resources are unavailable, the recipient’s mailbox is full (and it doesn’t accept more e-mails), the recipient is unknown, etc. Depending on the reason for the NDR, this message looks similar to this:

——————————————-

From: mailer-daemon

Sent: Wednesday, August 3, 2011 11:06:38 PM

To: Nuno Mota

Subject: There was an error sending your mail …

Auto forwarded by a Rule

I’m afraid I had problems forwarding your message. Full details follow:

Subject: ‘just testing a forwarding rule’

Date: ‘Wed, 3 Aug 2011 23:06:38 +0100 (BST)’

1 error(s):

SMTP Server rejected recipient (Error following RCPT command). It responded as follows: [550 unknown user nuno@msexchangeguru.com]

——————————————-

I have also attached the mail’s original headers. Sorry it didn’t work out.

What you can do is create a transport rule to BCC every e-mail sent to outside users and that contains, for example, the text “FW: There was an error sending your mail“, “FW: Mail delivery failed“, “FW: failure notice” in the subject to your Quarantine mailbox. This way, every time you see a huge number of NDRs for the same sender, all you have to do is go to the user’s mailbox and disable the forwarding rule (if that is the case of course).

This works fine, except for the times this happens during the night. You can easily get 2GB of NDRs in just a few hours…

So, another approach is necessary. You can change the transport rule to simply drop the e-mails, but this is not the ideal solution…

What about a script to analyse the transport logs regularly looking for a NDR Storm? If detected, the script can create a Transport Rule?

The following script does just that. It analyses the transport logs every 20 minutes and if it finds a user that forwarded 25 or more NDRs, it creates a transport rule just for that user to block those e-mails from going out and redirects them to the Quarantine mailbox so that the Administrator is aware.

When a rule is created, an e-mail notifying the administrator that a transport rule was created is sent as well. After this, all the administrator needs to do is wait for a couple of hours, login to the user’s mailbox, disable the rule and delete the transport rule. You should leave the rule in place for a couple of hours so that any delayed e-mails get blocked as well, otherwise it would start all over again.

The script by itself searches the logs once, creates the rule(s) if necessary and then terminates. If you want it to run regularly, please update AddMinutes(–20) to how far back you want it to search, create a batch file with a code similar to

PowerShell.exe -PSConsoleFile “C:\Program Files\Microsoft\Exchange Server\Bin\ExShell.psc1” -Command “. ‘D:\Scripts\PreventNDRsStorm.ps1′”

And then have a Schedule Task running the batch file every X minutes (this is one of the ways of running PowerShell scripts from the command line or from batch files).

The syntax to create transport rules in Exchange 2007 is completely different from 2010. In 2007, you have to configure all the conditions and actions first (just like in the script below) and then build the transport rule with those conditions. In 2010, it is much easier and similar to any other Exchange command.

New-TransportRule (2010) http://technet.microsoft.com/en-us/library/bb125138.aspx

New-TransportRule (2007) http://technet.microsoft.com/en-us/library/bb125138(EXCHG.80).aspx

So, if you are running a 2010 environment, just replace the whole code to create the transport rule with

New-TransportRule “Prevent NDRs Storm – $strName” -Comments ” Prevent NDRs Storm” -From $strNDR.Name -SentToScope “NotInOrganization” -SubjectContainsWords “FW: There was an error sending your mail”, “FW: Mail delivery failed”, “FW: failure notice” -RedirectMessageTo “quarantine@letsexchange.com” -Enabled $True

You can also replace -RedirectMessageTo with –DeleteMessage If you want to simply drop the e-mail.

Note that when you introduce a 2010 Hub Transport server in a 2007 environment for the first time, all the transport rules get copied to 2010 so that all servers have the same rules. After that, you have to create rules manually in both environments as they don’t get replicated between one another!

So, if you are currently in a co-existence scenario, please take this into consideration and update the script to reflect it.

# Get the date and time for 20 minutes ago. This will be the starting point to search the transport logs

$strStartFrom= (Get-Date).AddMinutes(–20)

# Get all the users who forwarded non-delivered messages to external users in the last 20 minutes. Group them so we can analyse the total number of e-mails sent

$strNDRs= Get-TransportServer | Get-MessageTrackingLog -ResultSize Unlimited -Start $strStartFrom -EventId SEND | ? {($_.MessageSubject -match“FW: There was an error sending your mail”) -or ($_.MessageSubject -match
“FW: Mail delivery failed”) -or ($_.MessageSubject -match“FW: failure notice”) -or ($_.MessageSubject -match“FW: Delivery Status Notification(Failure)”)} | GroupSender

# If we didn’t find any, simply exit

If ($strNDRs-eq$null) { Exit }

# For each sender, check if they sent more than 25 e-mails

ForEach ($strNDRin$strNDRs)

{

# If they sent more than 25 e-mails (in the last 20 minutes) and the user is an internal user, create the transport rule and send an e-mail to the administrator

If (($strNDR.Count -ge 25) -and ($strNDR.Name -match“msexchangeguru”))

{

# Create the Transport Rule

# For every e-mail sent by that user

$condition1= Get-TransportRulePredicate From
$condition1.Addresses = @(Get-Mailbox $strNDR.Name)

# only when the e-mail is going Outside the organization

$condition2= Get-TransportRulePredicate SentToScope

$condition2.Scope = @(“NotInOrganization”)

# and only when the subject contains any of these phrases
$condition3= Get-TransportRulePredicate SubjectContains
$condition3.Words = @(“FW: There was an error sending your mail”, “FW: Mail delivery failed”, “FW: failure notice”)

# Redirect the FW e-mail to the Quarantine NDRs mailbox

$action= Get-TransportRuleAction RedirectMessage
$action.Addresses = @(Get-Mailbox Quarantine)

# Get the user’s alias from the e-mail address to create the transport rule with it
$strName= [regex]::split($strNDR.Name, “@”)[0]

# Create the Transport Rule itself
New-TransportRule -Name “Prevent NDRs Storm – $strName” -Comments “Prevent NDRs Storm” -Conditions @($condition1, $condition2, $condition3) -Actions @($action) -Enabled $True -Priority 0

# Send the E-mail to the administrator

$body=“”

$body+=“`n**********************************”

$body+=“`n* *”

$body+=“`n* WARNING: NDR Storm Prevented *”

$body+=“`n* *”

$body+=“`n**********************************”

$body+=“`n`nTransport Rule Created for “, $strNDR.Name

$body+=“`n`nFW e-mails: “, $strNDR.Count

$FromAddress=“ndr.storm@letsexchange.com”

$ToAddress=“nuno.mota@letsexchange.com, exchange.admin@letsexchange.com”

$MessageSubject=“NDRs Storm!”

$SendingServer=“HTCAS1”

$SMTPMessage=New-ObjectSystem.Net.Mail.MailMessage
$FromAddress, $ToAddress, $MessageSubject, $body

$SMTPClient=New-ObjectSystem.Net.Mail.SMTPClient

$SMTPClient.Send($SMTPMessage)

}

}

Nuno Mota

Team @MSExchangeGuru

Posted August 4th, 2011 under Exchange 2007, Exchange 2010, Powershell, Scripting. RSS 2.0 feed. Leave a response, or trackback.