My company recently ran into this issue 2 weeks ago and confirmed with MS that it affects Exchange 2013 CU8, CU9, and CU10 (Exchange 2016 is fine). Basically any message that contains an X-OriginatorOrg header with a null or just white spaces will cause The FrontEndTransport Service to Crash. As long as that header contains any other info it’s fine.
Here is an example of what the message would look like
From: "Student Loan Notice"
MIME-Version: 1.0
To:
Subject: Forgiving Student Loans is possible
Content-Language: en-us
X-Originating-IP: 162.253.55.77
X-OriginatorOrg:
Content-Type: text/plain; charset=ISO-8859-1
Message body
Once this message is received by the FrontEndTransport service the following two event logs entries will occur. Once stating a messages with an invalid SMTP domain was found
Log Name: Application
Source: MSExchangeFrontEndTransport
Event ID: 1033
Task Category: SmtpReceive
Level: Error
Keywords: Classic
User: N/A
Computer: XCH201301.contoso.com
Description:
An exception was thrown while processing data from client IP address 192.168.250.125. The exception is System.FormatException: "" isn't a valid SMTP domain.
at Microsoft.Exchange.Data.SmtpDomain..ctor(String domain, Boolean check)
at Microsoft.Exchange.Transport.Agent.TrustedMail.InboundTrustAgent.GetOriginatingDomain(EndOfHeadersEventArgs endOfHeadersEventArgs)
at Microsoft.Exchange.Transport.Agent.TrustedMail.InboundTrustAgent.EndOfHeadersHandler(ReceiveMessageEventSource eventSource, EndOfHeadersEventArgs eventArgs)
at Microsoft.Exchange.Data.Transport.Smtp.SmtpReceiveAgent.Invoke(String eventTopic, Object source, Object e)
at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.Dispatcher.Invoke(MExSession session)
at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.MExSession.Invoke()
at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.MExSession.AsyncInvoke(Object state)
at Microsoft.Exchange.Data.Transport.Internal.MExRuntime.MExSession.BeginInvoke(String topic, Object source, Object e, AsyncCallback callback, Object callbackState)
at Microsoft.Exchange.Protocols.Smtp.DataBdatHelpers.RaiseEOHEvent(Object state, ISmtpInSession session, AsyncCallback callback, EndOfHeadersEventArgs eventArgs)
at Microsoft.Exchange.Protocols.Smtp.DataInboundProxySmtpCommand.RawDataReceived(Byte[] data, Int32 offset, Int32 numBytes)
at Microsoft.Exchange.Protocols.Smtp.SmtpInSession.ReadComplete(IAsyncResult asyncResult).
Followed by one entry for the crash of the FrontEndTransport service
Log Name: Application
Source: MSExchange Common
Event ID: 4999
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: XCH201301.contoso.com
Description:
Watson report about to be sent for process id: 87600, with parameters: E12IIS, c-RTL-AMD64, 15.00.1076.009, MSExchangeFrontendTransport, M.Exchange.Data, M.E.D.SmtpDomain..ctor, System.FormatException, 6379, 15.00.1076.009.
ErrorReportingEnabled: False
This will continue to happen until the message it removed from whatever upstream source is trying to deliver it to your Exchange server. MS has identified it as a bug and delivered us an out of band patch that applies to CU10 but can’t be applied to CU11. MS has told us that the fix will be included in CU12.
I originally posted this issue in the Exchange subreddit, any updates will be posted there.
