Exchange 2003 Email Not Delivered (Dropped) When Symantec Mail Security for Exchange (SMSMSE) Returns Error Message "This message has been set as bad mail on the SMTP server"

Article:TECH153939  |  Created: 2011-02-22  |  Updated: 2014-02-14  |  Article URL http://www.symantec.com/docs/TECH153939
Article Type
Technical Solution


Issue



Email is lost and not delivered.

NOTE:  This symptom and the associated 348 event (see below) typically occur as a result of other problems on the server.  For example if SMSMSE cannot read Antivirus definitions, SMSMSE may report the 348 event (see below). If the original issue is resolved or not encountered this issue does not appear either.


Error



 

  • SMSMSE reports the following error event in the Windows Application Event log:

 

Event Type:        Error
Event ID:            348
Date:                 1/1/2011
Time:                 1:34:10 PM
Computer:         SYMANTEC01
Event Source:    Symantec Mail Security for Microsoft Exchange
Event Category:                Unscannable
Description:
SMTP scanning failed on the message with subject: <subject> This message has been set as bad mail on the SMTP server.

 

  • Microsoft Exchange Transport Agent may report the following error event:
     

 

Event Type:        Error
Event ID:            348
Date:                 1/1/2011
Time:                 1:34:11 PM
Computer:         SYMANTEC01
Event Source:    MSExchangeTransport 
Description:
A message could not be virus scanned - this operation will be retried later. Internet Message ID <6B909A01FBA732458FCEF70C0A141D2DD500@user-name.<domain>>, Error Code 0x0.

 

Also see article How to Troubleshoot Windows Event Log ID 348 "A message could not be virus scanned - this operation will be retried later.".

 


Environment



  • Exchange 2003
  • Exchange is configured with no Badmail folder.

This is typically the case when Exchange SP1 or higher is installed. See Microsoft article The Badmail folder is disabled in Exchange Server 2003 SP1.


Cause



When SMSMSE is unable to scan an item, it is returning the "bad mail" status field when returning an error back to Exchange.  When Exchange is configured without a BadMail folder Exchange drops these emails silently.


Solution



Upgrade to SMSMSE version 6.5.5 or higher.

Instead of marking items as bad mail, SMSMSE will skip SMTP scanning on items that are inaccessible to the scanner during SMTP transport and report the following message in the Windows Application Event log:

 

Event Type:         Warning
Event ID:             408
Event Source:     Symantec Mail Security for Microsoft Exchange
Event Category:  Unscannable
Description:
SMTP scanning failed on the message with subject: <subject> This message will be rescanned upon reaching the mailbox only if you have configured rescanning on Mail Security for the mailbox role.
 

 

Technical Information

Use the article How to Troubleshoot Windows Event Log ID 348 "A message could not be virus scanned - this operation will be retried later." to determine why the message was inaccessible.

In some cases the email is available to the Outlook client through the Sync Issues Outlook folders (see attachment). If the Sync Issues folder is not in the list of Outlook folders click on the folder icon at the bottom of the Navigation Pane or hit Ctrl+6 to display the folder List.  See the following Microsoft article regarding using the Sync Issues folders: Synchronization error folders.


Attachments

Outlook Sync Issues folders
syncissues.jpg (8 kBytes)

Supplemental Materials

SourceETrack
Value2236061

SourceEvent ID
Value348
Description

SMTP scanning failed on the message with subject: <subject> This message has been set as bad mail on the SMTP server.



Article URL http://www.symantec.com/docs/TECH153939


Terms of use for this information are found in Legal Notices