When a message is submitted for delivery, the Microsoft Exchange Server
message transfer agent (MTA) may generate the following Event ID in the
Application Event Log:
MSExchangeMTA Event ID: 208
Type: Warning
Category: Security
The default latest delivery time for the message C=US;AMD;P=PRMD;L= has expired (10080 minutes after a submission). A non-delivery report has been generated with reason code unable-to-transfer and diagnostic code maximum-time-expired. [MTA XFER-IN 17 358] (14)
You may also notice the following events appearing in the application event
log intermittently:
Event ID: 208
Source: MSExchangeMTA
Type: Warning
Category: Security
Description: The default latest delivery time for message
C=US;A=NAME1;P=NAME2;L=EXCHANGE-00065E89 has expired (10080 minutes after submission). A non-delivery report has been generated with reason code Unable to Transfer and diagnostic code MAX TIME EXPIRED. [MTA XFER-I 23 358] (14)
Event ID: 290
Source MSExchangeMTA
Type: Warning
Category: X.400 Service
Description: A non-delivery report (reason code unable-to-transfer and diagnostic code maximum-time-expired) is being generated for message C=US;A=NAME1;P=NAME2;L=EXCHANGE-00065E89. It was originally destined for DN:/o=NAME1CORP/ou=NAME2CITY/cn=MS Mail Addresses/n=SMTP: someone@EXAMPLE.COM 2F52A9AC[ASCII 167] (recipient number 1), and was to be redirected to . [MTA DISP:ROUTER 14 136] <12)
In a large organization, this may be the only existing evidence that a
message is generating a non-delivery report.