Bounce backs and error codes for email can be very mysterious and misleading. To help with that we have started a new series on the blog dedicated to demystifying these occurrences. To read all of the blogs in this series, go here.

Bounce backs and error codes might look like they need to be deciphered with a secret decoder ring. We are going to try here to shed some light on them so you can crack them open and extract the goodness within. So let’s work together to understand the the two most common types of bounce backs. When a bounce back message is generated, the mail server that issued it is attempting to let you know there was a problem with sending the message and give you some information so you have an idea of what went wrong.

We are going to first break bounce backs into two main categories. Every bounce message will include a three digit number which is it’s “reply code”. This is different from the series of numbers, usually three, separated by periods. The reply code is defined by the SMTP protocol.  These other error codes are defined by specific mail server software packages and configurations and can be unique to each vendor.

The three digit reply code will either start with a 4 or a 5. These are commonly referred to as 400’s and 500’s as a group.

Basically if the number starts with a 4 it means the message delivery is having a temporary issue and will be delayed – these are called deferrals. If the message starts with a 5 then the message failed and was not sent to the recipient – these are called fatal message errors.

Deferrals (400)
A 400 bounce back indicates that there has been a delay or issue in sending your message. When this type of bounce back is sent to you, it means that your mail server will attempt to retry to send the message. If the retries are unsuccessful, the mail server will eventually stop trying to send the message after a specified amount of time. This amount of time is dictated by your server administrator but the typical time frame is a few days. If you don’t receive another bounce back it usually indicates that your message was able to be sent after a few tries and/or the issue was resolved. If you receive a fatal bounce back (500 error), it does mean that the message failed.

Fatal Bounce Back (500)
If the issue could not be resolved or there is another type of problem you may receive a 500 error. If the bounce back includes a 500 number, this means that the message was not delivered due to an error. The errors can vary across the board but typically it is an issue with one of the following: the email itself (misspelling, mailbox is full, etc.), your rDNS is not configured correctly, your server may be Blacklisted, or the message was blocked by the recipient spam filters due to content, attachment or a virus.

Remember that knowledge is power!  We at MxToolBox are constantly educating ourselves about all the different bounce backs that exist.  Also keep in mind that with some Vendors and ISPs you have the ability to create custom bounce back errors…so you always have to be on your toes!

If you are concerned about mail delays or other performance issues with your server we would highly recommend trying our Premium MailFlow Monitoring. This service sends a message through your server and back to our datacenter. This unique method allows us to provide complete mail flow visibility on your server. This can help uncover issues that might be creating delays as well as detecting both inbound or outbound mailflow failures.

In addition to alerts for failure, you can login to see daily, weekly and/or monthly historical statistics. This method allows you to get a true picture of the performance of your mail server.

Footnotes:
http://en.wikipedia.org/wiki/Non_delivery_report
http://tools.ietf.org/html/rfc821#page-35 – List of Reply Codes
http://tools.ietf.org/html/rfc821#page-48 – Theory of Reply Codes

Bounce backs and error codes for email can be very mysterious and misleading. To help with that we have started a new series on the blog dedicated to demystifying these mysteries. To read all of the blogs in this series, go here.

This is an error that our customers run into pretty often here are MxToolBox so we thought we would help explain the cause and provide some solutions to remedy it. By default Microsoft either installs/or recommends that the Intelligent Message Filtering (IMF) service be enabled on all installations of Exchange.

While the IMF can be somewhat helpful, it can be a detriment if you as the administrator don’t remember or even realize that it was installed on the server in the first place.  This can be especially troublesome when you have an additional 3rd party filtering service in place.  If you have IMF installed it essentially means you are double filtering your mail, once at the 3rd party spam filter and once at the Exchange Server. In cases that a 3rd Party Filtering is in place we typically recommend disabling the IMF feature. This is of course just a recommendation and you should do whatever you feel is best for your network environment.

How Does the IMF Identify Messages as Spam?
When a message reaches an Exchange Server with IMF installed, IMF will evaluate the textual content of the messages and then assign the message a Spam Confidence Level (SCL) rating from 1-9 based on the probability the message is Unsolicited Commercial Email (UCE).  This rating is then compared to the threshold set under Message Delivery Properties > Intelligent Message Filter in the Exchange System Manager.

How Do I Find Messages in the IMF?
Theoretically the IMF is supposed to place messages that it found as spam in your Outlook Junk Folder. Unfortunately, this doesn’t always tend to be the case.  If you have reports that messages are “missing” on your server and you can’t find them, check the IMF! To check this service, you will need to make sure that you have the Archiving option enabled. You can view the *Archived folder location here: C:program files[YOUR SERVER]mailroot[SMTP VIRTUAL SERVER]ucearchive.

*To view these archived messages you will need to download and install a 3rd-party tool.  If you have any recommendations regarding these tools, please leave them in the comments below.

Where is IMF installed?
When IMF is installed a new tab is added to the Exchange System Manager. For Exchange 2003, the tab is under Message Delivery > Properties under Global Settings.

There is also a new Intelligent Message Filtering node under Protocols > SMTP – This is where you enable IMF.

For Exchange 2007, it is under Exchange Management Console Server Configuration > Hub Transport > Anti – Spam.

As you may be aware, the native spam-filtering features in Exchange are typically too basic for most organizations.  While there is no question that IMF can improve Exchange’s ability to catch spam, you shouldn’t rely solely on this feature.  The IMF feature in Exchange simply cannot live up to the advanced heuristic spam, virus and phishing protection and controls featured in modern anti-spam and anti-virus products and services such as our own Spam and Virus Business Email Protection. We also include these services in our Email Hosting services.

Additional Sources:
http://technet.microsoft.com/en-us/library/bb266926(EXCHG.65).aspx
http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html
http://support.microsoft.com/kb/867633