| Event Id | 3015 |
| Source | MSExchangeTransport |
| Description | A non-delivery report with a status code of <number> was generated for recipient <recipient> (Message-ID <id>). |
| Event Information | CAUSE: This event is logged when a non-delivery report (NDR) is generated because Exchange mistakenly tried to deliver mail through an incorrect message transfer agent (MTA) route. The following are possible reasons that this failure would occur: 1. If a message bypasses the Exchange categorizer because custom sinks are installed, the Routing component can incorrectly send a valid SMTP mail for an SMTP recipient to the MTA. This would not occur under ordinary circumstances. 2. If the MTA Stacks service has been disabled and stopped for a long time, and then is re-enabled and started, the SMTP Store Driver may determine that the MTA is not started and return an NDR for messages bound for valid MTA recipients. 3. If a message is sent to a user on a non-Exchange messaging system such as UNIX sendmail, or another implementation that responds with a 5.3.0 at the SMTP protocol level, Exchange will log this response and wrap it into its NDR event. This generally has nothing to do with delivering to the MTA, although the event log may indicate that it does. RESOLUTION: Verify that routing and your topology are correctly configured. You can use the WinRoute tool to make sure that routes are correctly replicated between servers and routing groups. |
| Reference Links | Microsoft product: Exchange Version: 6.5.7638.0 Event Source: MSExchangeTransport Event ID: 3015 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.