2

I have an inbound email that a Get-MessageTrackingLog shows as arriving past the CAS server and into the mailbox server, but then shows as ExplicitlyDiscarded and HAdiscard.

RunspaceId              : f73e23f6-64e7-43b4-98bd-9871aabc5396
Timestamp               : 9/28/2015 8:53:10 AM
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : MAIL5
SourceContext           : ExplicitlyDiscarded
ConnectorId             :
Source                  : SMTP
EventId                 : HADISCARD
InternalMessageId       : 47266115095789
MessageId               : <C6DDD5D4A02A3742BFD356033E939FB6029F09FAEF@VPRDMBX02.outsidedomain.local>
Recipients              : {pay.roll@mydomain.com}
RecipientStatus         : {}
TotalBytes              : 15273
RecipientCount          : 3
RelatedRecipientAddress :
Reference               :
MessageSubject          : Your mailbox is almost full.
Sender                  : Deborah@outsidedomain.org.au
ReturnPath              : Deborah@outsidedomain.org.au
Directionality          : Incoming
TenantId                :
OriginalClientIp        :
MessageInfo             :
MessageLatency          :
MessageLatencyType      : None
EventData               : {[DeliveryPriority, None], [PrioritizationReason, ShadowRedundancy], [ExternalOrgIdNotSetReason, ]}

I can't seem to find anything online other than that this is normal in deleting a shadowcopy from the primary mail server after delivering the email to the mailbox. However, in this instance there is no final actual DELIVER into the mailbox itself. The above is the final portion of the tracking log, which normally would state as "DELIVER" to the mailbox, but never got that far.

Any ideas on how to determine what happened here on why the mail was discarded before the email was delivered to the mailbox itself?

TheCleaner
  • 32,627
  • 26
  • 132
  • 191

3 Answers3

1

Check the message ID on the e-mail. It might have the same message ID as another email and got explicitly rejected.

Chris M
  • 11
  • 1
0

The recipient might be configured to allow receiving from internal members of the organisation.

Guest1
  • 1
0

Have you checked the Application Log in Event viewer around the time the message was discarded to see if there's any indication of what happened?

Log Name: Application

Source: MSExchangeTransport

Task Category: SmtpReceive

Level: Warning

Also why are you getting a mailbox is almost full warning from outside of your organization? It could be the Exchange Spam filter discarding the message.

Also if you're running a DAG, make sure you check Delivery on the Active database server and not on the passive server. On the passive server I believe it will show a RECEIVE and SEND.. but not a DELIVER.

Methodman85
  • 1
  • 1
  • The email is definitely spam, you are correct there. The issue was that of the 192 mailboxes that this was sent to, only this one showed that it wasn't delivered to the mailbox. No DAGs here. I figured the EventData line would help show spam filtering inclusion, but maybe not. We don't keep the app logs long enough to see this one still, so maybe it will remain a mystery. – TheCleaner Oct 01 '15 at 20:11