Event ID 2004: Message Delivery Failed - Fix Guide 2025

Log Name:      Application
Source:        MSExchangeTransport
Event ID:      2004
Level:         Warning
Description:   Message delivery failed for the following recipient:
               Recipient: john.smith@external-company.com
               Reason: 550 5.1.1 The email account that you tried to reach
               does not exist. Please try double-checking the recipient's
               email address for typos or unnecessary spaces.

# Check current DNS configuration
Get-TransportService $env:COMPUTERNAME |
  Select-Object ExternalDNSServers, InternalDNSServers, ExternalDNSAdapterEnabled

# Set reliable external DNS servers (Google/Cloudflare)
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 8.8.8.8,8.8.4.4 -ExternalDNSAdapterEnabled $true

# Or use custom DNS for external queries
Set-TransportService $env:COMPUTERNAME -ExternalDNSServers 1.1.1.1,9.9.9.9

# Clear DNS cache and restart transport
Clear-DnsClientCache
Restart-Service MSExchangeTransport

# Verify DNS resolution now works
Resolve-DnsName -Name "gmail.com" -Type MX

# Verify SPF record exists for your domain
Resolve-DnsName -Name "company.com" -Type TXT | Where-Object {$_.Strings -like "*spf*"}

# Check if your server IP is blacklisted (manual check required)
# Visit: mxtoolbox.com/blacklists.aspx

# Verify send connector authentication
Get-SendConnector "Internet Send Connector" | Select-Object SmartHostAuthMechanism, AuthenticationCredential

# If using smart host, verify credentials
$cred = Get-Credential
Set-SendConnector "Internet Send Connector" -SmartHostAuthMechanism BasicAuth -AuthenticationCredential $cred

# Test outbound SMTP connectivity
Test-NetConnection -ComputerName smtp.gmail.com -Port 25
Test-NetConnection -ComputerName smtp.gmail.com -Port 587

# If blocked, check Windows Firewall
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*SMTP*"} | Format-Table

# Verify connector source IP is correct (multi-homed servers)
Get-SendConnector | Select-Object Name, SourceIPAddress, SourceTransportServers

# Set specific source IP if needed
Set-SendConnector "Internet Send Connector" -SourceIPAddress 192.168.1.50

# Retry all messages in retry state
Get-Queue | Where-Object {$_.Status -eq "Retry"} | Retry-Queue

# Retry specific queue
Retry-Queue -Identity "SERVER\contoso.com"

# Force immediate retry for all queues
Get-Queue | Retry-Queue -Resubmit $true

# Check if your IP is listed on major blacklists
# Run this from a machine with internet access
$serverIP = "YOUR.PUBLIC.IP.ADDRESS"
$blacklists = @(
    "zen.spamhaus.org",
    "bl.spamcop.net",
    "b.barracudacentral.org",
    "dnsbl.sorbs.net"
)

foreach ($bl in $blacklists) {
    $reversedIP = ($serverIP -split '\.' | ForEach-Object {$_})[-1..-4] -join '.'
    $lookup = "$reversedIP.$bl"$bl"
    try {
        $result = Resolve-DnsName $lookup -ErrorAction Stop
        Write-Host "LISTED on $bl" -ForegroundColor Red
    } catch {
        Write-Host "Not listed on $bl" -ForegroundColor Green
    }
}

# If listed, request delisting from the blacklist provider
# Also investigate WHY you were listed (spam, compromised account, etc.)

# Check TLS configuration on send connector
Get-SendConnector | Select-Object Name, RequireTLS, TlsAuthLevel, TlsDomain

# Check if remote server requires TLS
# If connection fails due to certificate issues:
Set-SendConnector "Internet Send Connector" -RequireTLS $false -IgnoreSTARTTLS $true

# Better: Create domain-specific connector with proper TLS
New-SendConnector -Name "Secure Partner Connector" `
  -AddressSpaces "SMTP:partner.com;1" `
  -RequireTLS $true `
  -TlsAuthLevel DomainValidation `
  -TlsDomain "mail.partner.com"

# Verify Exchange certificate is valid
Get-ExchangeCertificate | Where-Object {$_.Services -like "*SMTP*"} |
  Select-Object Thumbprint, Subject, NotAfter, Services

# Check current smart host configuration
Get-SendConnector | Where-Object {$_.SmartHosts} |
  Select-Object Name, SmartHosts, SmartHostAuthMechanism

# Configure smart host with authentication
$cred = Get-Credential -Message "Enter SMTP relay credentials"
Set-SendConnector "Internet Send Connector" `
  -SmartHosts "smtp-relay.example.com" `
  -SmartHostAuthMechanism BasicAuth `
  -AuthenticationCredential $cred `
  -Port 587 `
  -RequireTLS $true

# Test smart host connectivity
Test-NetConnection -ComputerName smtp-relay.example.com -Port 587

# If ISP blocks port 25, use submission port
Set-SendConnector "Internet Send Connector" -Port 587

# Check organization-wide limits
Get-TransportConfig | Select-Object MaxReceiveSize, MaxSendSize

# Check send connector limits
Get-SendConnector | Select-Object Name, MaxMessageSize

# Check receive connector limits
Get-ReceiveConnector | Select-Object Name, MaxMessageSize

# Increase limits organization-wide (example: 50MB)
Set-TransportConfig -MaxReceiveSize 50MB -MaxSendSize 50MB

# Increase on specific connector
Set-SendConnector "Internet Send Connector" -MaxMessageSize 50MB

# Note: Remote server may still reject large messages
# Check their bounce message for their limit

# 1. Send test message to previously failing recipient
Send-MailMessage -From "admin@company.com" -To "test@external.com" `
  -Subject "Delivery Test $(Get-Date)" -Body "Testing after Event ID 2004 fix" `
  -SmtpServer localhost

# 2. Track the test message
Start-Sleep -Seconds 30
Get-MessageTrackingLog -Start (Get-Date).AddMinutes(-5) -MessageSubject "Delivery Test*" |
  Select-Object Timestamp, EventId, Source, Recipients, RecipientStatus |
  Format-Table -AutoSize

# 3. Check queues are draining
Get-Queue | Select-Object Identity, Status, MessageCount | Format-Table

# 4. Verify no new FAIL events
Get-MessageTrackingLog -Start (Get-Date).AddMinutes(-30) -EventId FAIL |
  Measure-Object | Select-Object Count

# 5. Check Event Viewer for new 2004 events2004 events
Get-EventLog -LogName Application -Source MSExchangeTransport -Newest 50 |
  Where-Object {$_.EventID -eq 2004}

# Check SPF record
Resolve-DnsName -Name "company.com" -Type TXT | Where-Object {$_.Strings -like "*spf*"}
# Should return: "v=spf1 include:_spf.company.com ip4:YOUR.IP.ADDRESS ~all"

# Check DKIM selector
Resolve-DnsName -Name "selector1._domainkey.company.com" -Type TXT

# Check DMARC policy
Resolve-DnsName -Name "_dmarc.company.com" -Type TXT
# Should return: "v=DMARC1; p=quarantine; rua=mailto:dmarc@company.com"

# Schedule this to run hourly
$failedMessages = Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) -EventId FAIL
$queueDepth = (Get-Queue | Measure-Object -Property MessageCount -Sum).Sum

if ($failedMessages.Count -gt 10 -or $queueDepth -gt 500) {
    $body = "Mail Flow Alert on $env:COMPUTERNAME`n"
    $body += "Failed messages (last hour): $($failedMessages.Count)`n"
    $body += "Total queue depth: $queueDepth`n"
    $body += "`nTop failure reasons:`n"
    $body += ($failedMessages | Group-Object RecipientStatus | Sort-Object Count -Descending |
              Select-Object -First 5 | Out-String)

    Send-MailMessage -To "admin@company.com" -From "alerts@company.com" `
      -Subject "Mail Flow Alert - Delivery Failures" -Body $body `
      -SmtpServer "backup-smtp.company.com"
}

# Verify all send connectors are enabled and healthy
Get-SendConnector | Select-Object Name, Enabled, AddressSpaces, DNSRoutingEnabled, SmartHosts

# Check connector statistics
Get-SendConnector | ForEach-Object {
    $queue = Get-Queue -Filter "NextHopConnector -eq '$($_.Identity)'"$_.Identity)'"
    [PSCustomObject]@{
        Connector = $_.Name
        Enabled = $_.Enabled
        QueuedMessages = ($queue | Measure-Object -Property MessageCount -Sum).Sum
    }
}