The Microsoft Exchange Poison Queue is a little known queue on an on-premise Microsoft Exchange Server, maybe I’ve been lucky, but I’ve only seen emails end up here once in my time using Exchange Server which goes back to Exchange 5.5. However this week, we observed some messages going into the Poison Queue which were causing the Transport Service on the Exchange Server to keep restarting.
The Poison Queue is where messages go when they cause a failure in the Exchange Server, e.g. they crash one of the Server’s services. One of the most common causes is a plug-in installed on the server, perhaps this plug-in has a bug which is tickled by a particular email it processes causing it to crash, which in turn can cause one of the Microsoft Exchange services to crash.
Check for Event ID 10003 within the event logs (or any other’s that look suspicious for that matter), this should provide you with some indication of what and why that particular message is ending up in the Exchange Server Poison Queue and hopefully will point you towards the offending issue.
In our case we just choose to block the messages from the sender that were causing the issue, it was a meeting invitation from Google, other meeting invitations were coming through fine, so we believe it to have been caused by some weird set of characters on the email. Either way once we had blocked the email we cleared the poison queue of messages and we’ve seen no further issues.