Our Client has Exchange 2013 with GFI Mail Essentials. Recently Test-Mailflow started failing with no real reason to do so. Servers were up and running, mails were flowing but still Test-Mailflow is showing status failure.
Problem Description
We monitor the servers for our Clients with special scripts showing status of the servers and all their roles. It's all nice and green except Mail-Flow Test showing failures.
Additional verification with PowerShell confirms that issue is indeed there and not just script error.
While the error itself can have many reasons we've tracked it down to GFI Mail Essentials blocking it.
Solution
To solve this problem an exclusion has to be made for System Mailboxes. However this is not simply done by using WhiteList but has to be done thru Directory Harvesting Exclusions which is not done thru web interface. To do it one has to:
Find out all mailboxes that need exclusion. While the GFI Interface is able to deliver full name for System Mailboxes it's doing so while using lowercase email address.
When taking those emails make sure to properly format it SystemMailbox{….}@domain.pl otherwise it will be ignored. Additionally it seems GFI is showing different SystemMailboxes than the ones that are defined in Exchange, so you have to verify what GFI is showing in it's Dashboard on all your GFI instances. As you can see below PowerShell command shows different emails for arbitration mailboxes than those in GFI DashBoard.
[PS] C:\Windows\system32>get-mailbox -Arbitration | ft Name, PrimarySmtpAddress -AutoSize
Name PrimarySmtpAddress
---- ------------------
SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} SystemMailboxbb558c35-97f1-4cb9-8ff7-d53741dc928c@
SystemMailbox{1f05a927-a1fd-4ef6-96aa-50f419d0d2b7} MSExchApproval1f05a927-3be2-4fb9-aa03-b59fe3b56f4c@
FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@
SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} MsExchDiscoverye0dc1c29-89c3-4034-b678-e6c29d823ed9@
Migration.8f3e7716-2011-43e4-96b1-aba62d229136 Migration.8f3e7716-2011-43e4-96b1-aba62d229136@
After we've all emails ready for GFI Directory Harvesting Exclusions we have to modify config.mdb with Microsoft Access that's located in C:\Program Files (x86)\GFI\MailEssentials\Antispam.
Since editing config.mdb is not possible directly, make a copy of the file to PC with Microsoft Access, modify it there and replace original file.
As mentioned above, make sure SystemMailbox is formatted properly or it won't work. After replace is done on all servers make sure to restart all GFI Services (restarting GFI MailEssentials Attendant should fix it). Unfortunately this change has to be made on all servers with GFI.
And just like that Test-MailFlow works and shows success.
And in GFI Dashboard everything looks OK now.
