• Article

Failure DSNs Total - increase over 60 minutes - Yellow(>30) - Edge Transport

 

Topic Last Modified: 2007-11-16

The Microsoft Exchange Server 2007 Management Pack for Operations Manager includes a performance data collection engine that is used to query performance counter objects on computers that are running Exchange Server 2007. For this Operations Manager rule, data is collected using the performance counter specified in the Details table.

To review the value of the performance counter that generated this alert, do one of the following:

  • If you are using Microsoft Operations Manager 2005, from the Operator Console, select this alert, and then click the Properties tab. Review the description of the alert that includes the variables specific to your environment.

  • If you are using System Center Operations Manager 2007, double-click this alert, and then click the General tab. Review the description of the alert that includes the variables specific to your environment.

Details

Product Name

Exchange

Product Version

8.0 (Exchange Server 2007)

Event Source

MSExchangeTransport DSN

Counter Name

Failure DSNs Total

Instance Name

internal

Sample Interval (in seconds)

300

Server Role

Ex. Edge Transport

Warning Threshold

>30

Critical Error Threshold

>40

MOM Rule Path

Microsoft Exchange Server/Exchange 2007/Edge Transport/Transport

MOM Rule Name

Failure DSNs Total - increase over 60 minutes - Yellow(>30) - Edge Transport.

Explanation

The Failure DSNs Total performance counter represents delivery status notifications (DSNs) for failed message delivery.

This alert is triggered when more than 30 failure DSNs have occured in the last 60 minutes. Failure DSNs indicate that messages are not being delivered to one or more external DNS domains. Other symptoms that may occur when this threshold is reached are increased hard disk usage for transport log files, reduced server performance, or both. This alert may be caused by one or more of the following conditions:

  • Malicious effort to discover the contents of your Active Directory user SMTP e-mail alias. These malicious efforts are often called "dictionary" attacks.

  • Malicious effort to have your server trigger non-delivery report messages to the intended recipient. The reply address of the unsolicited commercial e-mail (UCE) is set to the intended recipient of the mail, but the mail is sent to a non-existent user in your domain. When the message is non-delivered, it will be sent to the SMTP e-mail address in the reply address field. In the end, your server will deliver UCE and may be block listed.

Important

Failure DSNs are not Read or Delivery Receipts.

For more information about delivery status notifications, see Managing Delivery Status Notifications.

User Action

To resolve this alert, do one or more of the following:

  • Examine the DSN for the exact cause of the failure and the SMTP domain of the recipient to determine if the DSN is legitimate.

  • Configure Recipeint Filtering for users not in Active Directory on the Hub Transport server. For information, see Configuring Recipient Filtering.

If you are unable to identify and resolve the problem and if the Failure DSNs Total performance counter does not decrease or continues to increase, contact Microsoft Technical Support. For information about how to contact support, visit the Contact Us page of the Microsoft Help and Support Web site.

For More Information

To search the Microsoft Knowledge Base articles based on criteria that generated this alert, visit the Microsoft Help and Support Web site.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.