It's Bedlam all over again...

A really long time ago, I wrote a post about the "Bedlam DL3" event at Microsoft.

Well, a couple of days ago, we had another Bedlam DL3 event.  For some reason, the permissions on one of our internal DLs were messed up, and someone had granted "send-as" permission to all 2500 members of the DL.

Someone then sent a message to the DL with the From: field set to the DL (I have no idea why, or who did it, but they did it).

That person then realized that they had made a mistake and they tried to recall the message.

The problem is that message recalls are handled on the outlook client (all 2500 of them).  So every recipient of the message sent a "Recall Success" or "Recall Failure" message to the sender of the email message.

 

And the Exchange servers proceeded to.....

 

Slow WAY down.  Not surprisingly, given that they were handling what was estimated at 36G of email (2500 emails sent to 2500 recipients is 6.25 million emails, each email was about 6K bytes long).

But they handled it with aplomb.  Even a 36G email bomb was handled by the servers.  Email backed up for several hours, but the servers didn't crash.  Man, things have improved since way back when.

 

The best part of this was that the email alias in question was a security-related email alias.  So everyone on the DL was sending emails to the DL speculating about who was pen-testing the live Exchange servers :)  All the while the queues were being drained and clients were actively using the system.

 

I was pretty impressed, to be honest.