Hours of delay on all incoming mail.

[kharnal]

I've recently been having trouble with e-mails being delayed between the outgoing server and ours. There is no trace of the e-mail hitting our server prior to the "received" time found in the headers. No hops in between us and the sending e-mail server, it looks like they are connecting directly. The message delays average between 1 and 5 hours, but I have seen delays of up to 24 hours.

Often mail will not come in from a particular domain all day, and then sometime in the afternoon many e-mails from that domain will come through at once. All of the mail will have around the same "received" time but varying "sent" times. Meanwhile, mail from other domains will be received just fine.

This problem happens with e-mail from many different domains, and is unpredictable when it will occur. It has been especially bad today.

We have no problems with outgoing mail.

Here is an example header from a delayed mail.
=========
Microsoft Mail Internet Headers Version 2.0
Received: from test.test1.com ([72.18.3.132]) by sm-svr02.test2.test3.COM with Microsoft SMTPSVC(6.0.3790.1830);
Mon, 5 Feb 2007 16:18:35 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7495A.1DD91A00"
Subject: Croft Order
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Date: Mon, 5 Feb 2007 11:16:20 -0800
Message-ID: <7AD7CC7A22AD274C90205904DBAEF8EB1D0B8B@test.test1.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
From: "Rose La" <rla@test1.com>
To: "Planwell Operators" <PLANWELL@test2.COM>
Return-Path: rla@test1.com
X-OriginalArrivalTime: 06 Feb 2007 00:18:35.0208 (UTC) FILETIME=[57463C80:01C74984]

------_=_NextPart_001_01C7495A.1DD91A00
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

------_=_NextPart_001_01C7495A.1DD91A00
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable


------_=_NextPart_001_01C7495A.1DD91A00--

 

[58sniper]

What do the event logs say?

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[kharnal]

I'm wondering if it's that domain name.

sm-svr02.test2.test3.COM

 

[ShackDaddy]

What are you running as an anti-spam tool on your network? Anything on the mail server? Sounds like it might be a badly configured greylisting.

ShackDaddy
Shackelford Consulting

 

[kharnal]

We're just using IMF

here's a little more info.

As far as SMTP logging, I'm getting a ton of EID 7010

responding to people with a 503 5.5.2 Sender already specified.



I found another forum posting of a similar issue here.

(delayed mail, EID 7010, BUT this person had hops between the sending and receiving mail server that seemed to have been delaying the mail.)

http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=826711&SiteID=17

 

[kharnal]

Only the e-mails with attachments are being delayed it seems.

 

[ShackDaddy]

Sounds like a problem with your AntiVirus scanning queue at this point. What are you using for AV?

ShackDaddy
Shackelford Consulting

 

[kharnal]

Symantec, AV. I've excluded my exchange from the scans though.

 

[ShackDaddy]

Do you have ANY 3rd-party product that integrates with Exchange installed? Archiver? 3rd-party service that scans mail before it gets to your network?

ShackDaddy
Shackelford Consulting

 

[kharnal]

no

 

[ShackDaddy]

What options are you using in the IMF?

ShackDaddy
Shackelford Consulting

 

[kharnal]

previously I was using a custom weight xml file, but I disabled that.

The trouble seemed to go away once I disabled NDRs and reduced the accepted attachment size.

Not exactly a permanent solution.

 

[gerbieIT]

Are you running the mail secuirty for Symantec? I have seen that do it when the auto protect feature is on.