I've had a hard time tracking down the cause to an email issue from a client's client not reaching us. We noticed we were no longer getting their maintenance emails. Scanning our message logs using:
Get-MessageTrackingLog -Start 9/9/2016 -Results unlimited |select *| where { [string]$_.Sender -like '*DOMAIN*'}| Out-GridView
but the results never came back explaining why we never got their messages.
Then they sent us the rejection message:
5.1.1 smtp; 550 5.1.1 User unknown> #SMTP#
Only by reaching into our Frontend logs did I find it (C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\RECV*.log)
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders250-mail.OURORGMAIL Hello [IP]
250-SIZE 20971520
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-BINARYMIME
250 CHUNKING
MAIL FROM:<LIST@DOMAIN.com> SIZE=4954
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
08D3D3BAEA43106B;2016-09-09T17:17:48.855Z;1
RCPT TO:<validuser1@OURORGMAIL> ORCPT=rfc822;validuser1@OURORGMAIL
250 2.1.0 Sender OK
250 2.1.5 Recipient OK
RCPT TO:<validuser2@OURORGMAIL> ORCPT=rfc822;validuser2@OURORGMAIL
RCPT TO:<validuser3@OURORGMAIL> ORCPT=rfc822;validuser3@OURORGMAIL
RCPT TO:<invalideuser@OURORGMAIL> ORCPT=rfc822;invalideuser@OURORGMAIL
DATA
250 2.1.5 Recipient OK
250 2.1.5 Recipient OK
250 2.1.5 Recipient OK
354 Start mail input; end with <CRLF>.<CRLF>
Proxy destination(s) obtained from OnProxyInboundMessage event
Tarpit for '0.00:00:05' due to '550 5.1.1 User unknown'
550 5.1.1 User unknown
QUIT
My search above never returned this User unknown. This is the first time I've had to search for a user unknown on Exchange 2013 (2+years after upgrading from 2010) and I kind of recall 2010 would return unknown user errors in the get-messagetrackinglog output.
Am I wrong that 2010 never did this or that this is a bug for Exchange 2013 or am I just using the wrong powershell command to search?
Our version is 15.0 (Build 1130.7)
Thanks!