RecipientStatus RESOLVER.GRP.Expanded; distribution list expanded

Question

Hi. Exchange 2019. On-premise.

There's a mailing list group. It has permission to receive mail from the Internet.

Everything works, but one email didn't arrive.

Timestamp : 7/24/2024 2:39:00 PM

ClientIp :

ClientHostname : MS-EX01

ServerIp :

ServerHostname :

SourceContext :

ConnectorId :

Source : ROUTING

EventId : DROP

InternalMessageId : 212626650959119

MessageId : <6FB3FCD2030EA34FA92D53F17ED010F4013622@MANUSCRIPT3.kommersant.local>

NetworkMessageId : abcf3452-75c6-43a6-ea75-08dcabd5354c

Recipients : {pr@Hidemydomain.com}

RecipientStatus : {[{LED=250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded};{MSG=};{FQDN=};{IP=};{LRT=}]}

TotalBytes : 25097

RecipientCount : 1

RelatedRecipientAddress :

Reference :

MessageSubject : вопросы для комментария

Sender : Yakushko@kommersant.ru

ReturnPath : Yakushko@kommersant.ru

Directionality : Originating

TenantId :

OriginalClientIp :

MessageInfo :

MessageLatency :

MessageLatencyType : None

EventData : {[DeliveryPriority, Normal], [AccountForest, MyFQDN]}

TransportTrafficType : Email

SchemaVersion : 15.01.2507.039

I found information here that the group is closed. But it's open.

https://www.exchangelog.info/2023/08/reason-led250-215-resolvergrpexpanded.html

PS C:\Windows\system32> Get-DistributionGroup -Identity "PR@mydomain.com" | Format-List Name,RequireSenderAuthenticationEnabled

Name : pr

RequireSenderAuthenticationEnabled : False

How can I understand for what reason the message is DROP ?

Answer 1

DROP can be a misnomer with a group.

The status tells you why it was dropped

{[{LED=250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded};{MSG=};{FQDN=};{IP=};{LRT=}]}

so all that means is once the list was expanded, the message to the group itself was dropped and now the message will be delivered to the recipients themselves.

If a message is missing, what is the event and recipient status of the message for that specific user?

Answer 2

Hi @Андрей Михалевский,

Welcome to the Microsoft Q&A platform!

The DROP event in the message tracking log is a clear indicator that the message was intentionally discarded by Exchange. Given the information you've provided, it seems the message routing process decided to drop the message even though the distribution group is configured to accept emails from external senders.

Here are a few potential reasons why your email might have been dropped:

1. It's possible that Exchange content filters or transport rules may have flagged the email as spam or malicious, resulting in it being dropped. Review any transport rules or anti-spam filters that might be in place to see if this email could have triggered one of them.
2. Sometimes, an issue can occur during the expansion of the distribution group. Even though the group is set to allow external senders, there might be an underlying problem with the group itself or its membership.
3. Ensure that the recipient address (pr@Hidemydomain.com) is correctly configured and not accidentally blacklisted or filtered out by an anti-spam mechanism.
4. Although the provided log does not indicate an issue with message size (TotalBytes: 25097), it's still worth checking the size restrictions for both the group and the individual members.
5. Verify that the sender's domain (kommersant.ru) is not on any blocklists and that SPF/DKIM settings are appropriately configured and passing.

It is recommended that you follow the steps below to troubleshoot：

1. Message Size Restrictions:
   • Review any existing transport rules in your Exchange environment that might apply to this message and result in it being dropped.
   • You can use the following cmdlet to list transport rules:

      Get-TransportRule | Format-List Name,Description
   

2. If you have access to other messages from the same sender that were successfully delivered, compare the headers to identify any discrepancies.
3. Inspect content filter logs for any indication that the message was flagged and dropped.
4. Ensure that the anti-spam settings in your Exchange environment are not overly aggressive.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang