Back to All Scenarios
PASSEDinfrastructure / email_attachment_size_bounce_storm
Email Attachment Size Policy Causing Bounce Storm
A message size limit reduction on the Exchange transport rule causes a bounce storm. Automated systems sending reports with large attachments generate NDRs, which trigger auto-reply rules, creating a feedback loop of bounces and replies that overwhelms the mail system.
Pattern
EXCHANGE_EVENT
Severity
CRITICAL
Confidence
85%
Remediation
Remote Hands
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | EXCHANGE_EVENT | EXCHANGE_EVENT | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 4 linked | |
| Cascade Escalation | N/A | No | |
| Remediation | — | Remote Hands — Corax contacts on-site support via call, email, or API |
Scenario Conditions
Exchange Server 2019. Message size limit reduced from 25MB to 10MB. 12 automated report systems sending 15-20MB attachments. NDRs trigger auto-reply rules. Feedback loop generates 50,000+ messages in 2 hours. Mail queue at 78,000 messages.
Injected Error Messages (1)
Exchange mail flow overwhelmed — message queue at 78,000 messages after bounce storm, transport rule rejecting attachments over 10MB generating NDRs, auto-reply rules creating feedback loop with NDR responses, mail flow completely blocked, exchange transport hub queue growing at 400 messages/minute, legitimate email delayed by hours
Neural Engine Root Cause Analysis
Exchange Transport service is experiencing a mail flow cascade failure caused by a transport rule rejecting attachments over 10MB, which generates NDRs (Non-Delivery Reports). These NDRs are triggering auto-reply rules that create a feedback loop, exponentially increasing the message queue to 78,000 messages. The combination of the attachment rule rejection storm and the NDR auto-reply feedback loop has completely overwhelmed the transport service, blocking legitimate mail flow.
Remediation Plan
1. Immediately disable problematic auto-reply rules causing NDR feedback loops 2. Temporarily disable or modify the 10MB attachment transport rule to stop generating new NDRs 3. Drain the message queue by increasing transport service resources or manually purging NDR messages 4. Monitor queue reduction and mail flow restoration 5. Implement proper NDR suppression rules before re-enabling attachment restrictions 6. Review and fix auto-reply rule configurations to prevent future feedback loops
Tested: 2026-03-30Monitors: 1 | Incidents: 1Test ID: cmnck1rgp0674obqe7x1oz5nn