This is more of a generic sendmail question. This is on a AIX server but I think tracing send mail would be the same.
There is some process sending a bad mail message.

It looks like some user has written a bad script and now I am getting a bunch of messages like this in my outlook mail box.

What I am trying to do it track down the offending job. I looked at a bunch of the crons but this is a sybase server and tons of jobs.

I was considering writing a wrapper that would call my script first before sendmail and see if it could capture some information.

There is not much information in the bounced message.
Is there a way to stop sendmail so the mail will queue up and I can try to trace the job before it leaves the server.

daemon@xxx.mydomain.com
A problem occurred during delivery of this message. Microsoft Exchange will not try to redeliver this message for you. Please try resending this message later, or provide the following diagnostic text to your system administrator.


Diagnostic information for administrators:

Generating server: xxx.mydomain.com

daemon@xxx.mydomain.com
#< #5.3.0> #SMTP#

Original message headers:

Return-Path: <MAILER-DAEMON>
Received: from localhost (localhost) by xxx.mydomain.com (AIX4.3/8.9.3/8.9.3)
with internal id IAA51924; Mon, 24 Oct 2011 08:00:01 -0400
Date: Mon, 24 Oct 2011 08:00:01 -0400
From: Mail Delivery Subsystem <MAILER-DAEMON>
Message-ID: <201110241200.IAA51924@xxx.mydomain.com>
To: daemon
MIME-Version: 1.0
Subject: Returned mail: Insufficient permission
Auto-Submitted: auto-generated (failure)
X-MIMETrack: Itemize by SMTP Server on xxx/GATEWAY/SRV/xx(Release 6.5.6FP2|October
17, 2007) at 10/24/2011 07:55:31 AM,
Serialize by Router on xxx/GATEWAY/SRV/xxx(Release 6.5.6FP2|October 17, 2007) at
10/24/2011 07:55:32 AM,
Serialize complete at 10/24/2011 07:55:32 AM
Content-Type: multipart/report; report-type=delivery-status;
boundary="IAA51924.1319457601/xxx.mydomain.com"

My thought too is could it be another server trying to send back to my server. And if it is how can I trace that. My mail team was not able to get any information form the header of the email.

Well I confirmed its not coming from my server. I removed the x bit from mail and mailx and I still get the email in outlook.

So I am guessing some windows or some other unix box is trying to send this mail. I even put aliases of daemon: /dev/null in the /etc/aliases file and its still coming out.
I even tried to fwd the mail to root in the aliases file and nope nothing came in.

Seems like a reasonable assumption that some other system is sending it. Now to track that down.

So this is interesting...

I manged to start sendmail manually in the on the server and can now mail daemon@myserver.com and i get email.
to root fine.

Strange this is the messages I was seeing are not going to root or daemon now. The don't bounce back. So now I am not sure where they are going.

edit:
I just got a mail from a at job...
bummer it just send the bounce mail again... oh well keep looking.

I turned on syslog to see if i can trace this. Here are the step i used in case it helps anyone else. I am sure its the same or close for linux.

# cp /etc/syslog.conf /etc/syslog.conf.10242011
# echo "mail.debug /tmp/mail.log" >> /etc/syslog.conf
# touch /tmp/mail.log
# refresh -s syslogd

Im still chasing this issue but I think I narrowed it down to a db process.