Windows Server · critical · Exchange, WSUS, PKI & RDS

Exchange transport queues back up and mail stops flowing

Transport has stopped accepting or delivering mail, usually because of back pressure from low disk space or a delivery failure that is retrying.

What you see

Mail queues climb, internal delivery stalls, and senders receive 452 or 451 responses. Nothing is obviously down.

What is actually wrong

Back pressure from a full transport database volume is the most common. Beyond that: a DNS failure preventing outbound delivery, or a receive connector refusing mail after a certificate change.

Codes and articles

451 4.4.0452 4.3.1 Insufficient system resourcesback pressureQueue Viewer550 5.7.1Event 15006

Fixes (3)

Relieve back pressure

Exchange Management Shell45 minutesmedium riskreversible

Everything has stopped, including internal mail.

Confirm back pressure is active — the event log states which resource is under pressure.
PowerShell
```
Get-WinEvent -LogName Application -MaxEvents 100 | Where-Object { $_.Id -in 15004,15005,15006,15007 } | Format-List TimeCreated,Id,Message
```
Back pressure is Exchange deliberately refusing mail to protect itself. The event names the exact resource — disk, memory or queue database — which turns this from a search into a single check.

Check free space on the transport queue and log volumes.

PowerShell

Get-Volume | Format-Table DriveLetter,FileSystemLabel,SizeRemaining,SizeGet-ChildItem 'C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue' | Measure-Object Length -Sum

The most common cause is transaction logs filling the volume because backups have stopped. Check when a successful backup last ran before deleting anything.
PowerShell
```
Get-MailboxDatabase -Status | Format-Table Name,LastFullBackup,LastIncrementalBackup,DatabaseSize,AvailableNewMailboxSpace
```
Logs are truncated by a successful backup. Deleting them by hand breaks the ability to recover the database to a point in time, so a backup that completes is always the right way to reclaim the space.
Run a successful backup to truncate the logs, or move the queue database to a larger volume.

Check the queue state.

PowerShell

Get-Queue | Format-Table Identity,DeliveryType,Status,MessageCount,NextHopDomainGet-Queue | Where-Object MessageCount -gt 100 | Format-List

Restart transport once space is available.
PowerShell
```
Restart-Service MSExchangeTransport
```

Confirm it workedQueues drain and no back pressure events appear.

PowerShell

Get-Queue | Format-Table Identity,Status,MessageCountGet-ExchangeDiagnosticInfo -Process EdgeTransport -Component ResourceThrottling | Select-String -Pattern 'ResourceUtilization|Pressure'

If you need to undo itNothing was removed if the backup route was used.

Fix outbound delivery

Exchange Management Shell40 minutesmedium riskreversible

Only outbound mail is queuing.

Look at the queue for a specific destination and read the last error.

PowerShell

Get-Queue | Where-Object DeliveryType -eq 'SmtpRelayToRemoteAdSite' -or $_.NextHopDomain -notlike '*local*' | Format-List Identity,Status,MessageCount,LastError

The LastError field usually contains the whole answer — a DNS failure, a connection refused, or a rejection from the recipient's server.

Test DNS resolution for the destination, from the Exchange server itself.

PowerShell

Resolve-DnsName -Type MX gmail.comTest-NetConnection alt1.gmail-smtp-in.l.google.com -Port 25

Check the send connector's configuration and whether it should be using a smart host.
PowerShell
```
Get-SendConnector | Format-List Name,AddressSpaces,SmartHosts,DNSRoutingEnabled,Enabled,Port
```
If the destination is rejecting on reputation, check whether the public IP is on a block list and whether SPF, DKIM and DMARC are published correctly.
PowerShell
```
Resolve-DnsName -Type TXT example.com | Where-Object Strings -like '*spf*'Resolve-DnsName -Type TXT _dmarc.example.com
```
A rejection at the far end is not an Exchange fault and no amount of restarting will clear it. The DNS records are where the fix is, and they are checkable in seconds.
Retry the queue once the cause is addressed.
PowerShell
```
Get-Queue | Retry-Queue -Resubmit $true
```

Confirm it workedThe queue drains and a test message reaches an external recipient.

PowerShell

Get-Queue | Format-Table Identity,Status,MessageCount

If you need to undo itConnector changes can be reversed with Set-SendConnector.

Fix inbound acceptance

Exchange Management Shell40 minutesmedium riskreversible

Only inbound mail is failing.

Check the receive connectors and which addresses they accept from.

PowerShell

Get-ReceiveConnector | Format-Table Identity,Bindings,RemoteIPRanges,Enabled,AuthMechanism,PermissionGroups -AutoSize

Test SMTP by hand from outside to see the actual response.
PowerShell
```
Test-NetConnection mail.example.com -Port 25 -InformationLevel Detailed
```
Check the certificate bound to SMTP has not expired — an expired certificate causes TLS negotiation failures that present as a connection that opens and closes.
PowerShell
```
Get-ExchangeCertificate | Format-Table Thumbprint,Services,NotAfter,Subject -AutoSize
```
Most senders now require TLS. An expired certificate does not produce a clear error at the receiving end — the connection simply drops after the STARTTLS, which looks like a network problem.
Rebind the certificate if it has been renewed but not assigned.
PowerShell
```
Enable-ExchangeCertificate -Thumbprint ABC123 -Services SMTP,IIS
```

Check the anti-spam agents are not rejecting legitimate senders.

PowerShell

Get-TransportAgent | Format-Table Identity,Enabled,PriorityGet-IPBlockListEntry | Format-Table IPRange,Comment

Check the message tracking log for what happened to a specific message.

PowerShell

Get-MessageTrackingLog -Sender 'someone@example.com' -Start (Get-Date).AddHours(-4) | Format-Table Timestamp,EventId,Source,Recipients,MessageSubject -AutoSize

Confirm it workedA test message from outside is delivered and appears in the tracking log as DELIVER.

If you need to undo itCertificate bindings and connector settings can be restored to their previous values.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.