Significant Delays receiving email Exchange 2003 Svr

NotSoKlear
NotSoKlear used Ask the Experts™
on
The follwing issue showed up around 1 week ago... until then everything was working fine.

Simply put, my exchange 2003 server isnt either receiving or processing email in a timely fashion. I have people who are sending emails to valid emails on the exchange server and they are processed almost immediately. At other times the same senders’ emails are not received into the exchange email box for 30 minutes to 4 hours after the email was sent.

I’ve looked at the logs, changed the hardware (DSL modem w/ static IP's) looked at the error reports, ensured my DNS and RDNS is correct - telneted into SMTP on the server a million times- everything checks out. The only thing that DOES NOT make sense is the inconsistency (sp) of when/how the emails are received.  Therefore, I unfortunately do not have the consistency of a single point of error and/or I am looking at the wrong place for a solution.

ANY help with this will be much appreciated. I’m not new to SMTP or Exchange, but just can’t get my head out of the forest so to speak.

If you can help, please let me know what information you may need to assist me with this.
Thanks in advance.
Bob

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Is this delay happening randomly or at a specific time period?
During this delay, if you check the message queue, do you find any message there?
Did you try disabling the anti-virus software for testing purposes?
Bob, this might sound too easy, but have you tried restarting the Information Store and/or the server?

Author

Commented:
rr186 -

The delays happen at random times during the day.
The messages are not in the queue. I have noticed that once they get to the queue that are sent immediately to the mailbox.
Yes sir, I disabled the anti-virus and spam filter to make sure.

Vanbarsoun-

Any suggestion at this point is well accepted and very much appreciated.
I did reset the Information Store and the server.

Any other ideas?

Rowby Goren Makes an Impact on Screen and Online

Learn about longtime user Rowby Goren and his great contributions to the site. We explore his method for posing questions that are likely to yield a solution, and take a look at how his career transformed from a Hollywood writer to a website entrepreneur.

Correct me if I am wrong, you are having delays only when receiving emails from external domains? You are able to send
How is the mail flow internally between users?

Author

Commented:
rr1968-
Yes the only significant issues we are having is receiving emails (intermitently) from outside senders.

There has been some slow down internally, but they are still receiving emails almost immediatly.

Bob
Did you test your MX record status?
go to www.mxtoolbox.com and enter your domain name and check the SMTP test and let me know if you see any issues...

Author

Commented:
mx record status/test checked out just fine...
not blacklisted and the smtp test worked out great.

I was just getting ready to post, but to let you know I have two exchange servers. I changed the receiving server and am still getting the some of the same results with the delayed emails.

I am going to restart the server again tonight along with doing some maintenance (defraging) the IS. I dont think it will make a difference, but - at least ill know that is taken care of. Any other ideas?

Thanks,

Bob
Are you receiving directly into Exchange, or is there an upstream mail receiving device?

Author

Commented:
VanBarsoun:
Receiving directly into the exchange server.

Bob

Commented:
This sounds like filesystem antivirus or backup solutions scanning the Exchange directories.  I know you've said that you've stopped the antivirus, but it's not clear whether you've stopped Exchange A/V or filesystem A/V or both.  Additionally, if there is A/V on another machine performing on-access scan across the network of these directories, they will result in a delay.

Please verify one of the delayed emails in the SMTP logs, to see when it arrived at your server from the Internet vs. when it was delivered to the mailbox in the Message Tracking Logs.  You'll need to enable SMTP protocol logging and message tracking in Exchange System Manager of course.  

Author

Commented:
tmeunier -

Before I get into your post.... an update.

I moved the SMTP virtual server to the secondary server and that seemed to have been a step in the right direction. All but one of the users (the boss of course) is now getting email in a timely manner (=<15 minutes from time being sent from outside sender).

As for the boss - I would say 90 to 95% of his emails are getting to his email box within a reasonable amount of time. However, the other percentage are still 40 minutes up to 8 hours in delay. Its reasonable (I think) to assume that the initial server may have been the cuplrit (and still may be) as the boss' email box still resides on that server. Not to mention that I tried to run an eseutil /d (this past weekend) on the original mailstore (where the boss' email resides).... got through about 30% of a 12 gig priv.edb and through out a time out error.

So, to your post:

Couple of things, the A/V has been turned off on the Server (for now).... I have been running manual scans (ugh).
Interesting though about the backup question - never thought of that - does BU exec 10.d continually scan the email boxes and stores if they are selected for backup or only when backing up. Reason I ask is that the delay is occuring throughout the day and not at any specific time.

I will turn the smtp logs back on and message tracking in exchange system manager now. I'm not too familiar with the message tracking function... but, will look into it and see if i can figure it out.

Thanks for you assistance.

Bob

Author

Commented:
I thought it might be helpful if I posted on of the delayed email headers here as well. I noticed RDNS failure, but whats odd is that the xoriginal  time is:

X-OriginalArrivalTime: 25 Oct 2010 21:06:58.0624 (UTC) FILETIME=[8FBF3C00:01CB7488]

Microsoft Mail Internet Headers Version 2.0
thread-index: Act0iJAC4u2YflJ/TLOmU0IQxo8A2g==
X-SEM-SMTP: 1
Received: from recvexchange.com ([192.168.1.3] RDNS failed) by recvexchange.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 25 Oct 2010 14:06:59 -0700
Received: from web33502.mail.dirt.sender.com ([68.142.206.151]) by recvexchange.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 25 Oct 2010 14:06:55 -0700
Received: (qmail 62970 invoked by uid 60001); 25 Oct 2010 17:06:54 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sender.com; s=s1024; t=1288026414; bh=/Dk8Bv2KB13j3hm04WpgYJZ3ezNYV/dwzji+jB5YRV0=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=SH5M/SJxIrf3nf9sPMZgmbbExWtLFaX2fV6Clabeamg0qX4JuvL+Axp7kN14+LEa3jpqvrmB0J243pXnUJ97ZxBsKex7UXeLr8ukh8IFnj+FFm/a//HPS0Z/BdBbGgPWgtOBKmIGos7Aaik4Esrt3C5CcW+csJddM8I2zi/FJX8=
Content-Transfer-Encoding: 7bit
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;  s=s1024; d=sender.com;  h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;  b=Er1h8tEV+r7UF+94EXFQvE/m2dm94tn9YEf5wirgdybmnoVNtsKquCPC0hiTnY4RIXqWifHaObGOJqs1809KKz7BH4hjrJCXsTx8zI25B5r5nP0EEjJKYs/n7aQpmCd1Q9xpql4ThqRjd3zPBB+6BxooLfgC8Jz1U07bzn+2F3g=;
Message-ID: <230424.59149.qm@web33502.mail.dirt.sender.com>
X-YMail-OSG: iQhXST0VM1njwsEkceBHeA.7yYWzh_ASPPOvfXTqTpZMIue KTdMnoXaSDLjeXNlwexgzgC_7xXvzB5nzYzGV.NVrGSqksLk2S06C6BaS6RO _ORezKQEGyBfM04VjwKih8Xr8rGDgaF9yYVk_KPN5eioDiIWhh9LxVuFxCm5 WGScfSJKp.NtF8.SXfAHrzQg6OZClPHGfj9a.CLuNO5RUoTTxTpOomuvW6BX 1TuV4FX05hgtEqs6N7Vyoxty3t8NLaD7TkcnYNDG.AOFpG3_pQ5wn7qTE2GD AfqiyzlkD.4u0yPy8rr4QkAeBMT3IKZgRKmCaXbDTBZ9n39xTAcQ.8.E-
Received: from [204.153.155.151] by web33502.mail.dirt.sender.com via HTTP; Mon, 25 Oct 2010 10:06:54 PDT
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4133
X-Mailer: YahooMailRC/504.5 YahooMailWebService/0.8.107.284920
Date: Mon, 25 Oct 2010 10:06:54 -0700 (PDT)
From: "Sender" <sender@sendersdomain.com>
Subject: Hey
To: <recipient@recvexchange.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
      boundary="0-600182225-1288026414=:59149"
Return-Path: <sender@sender.com>
X-OriginalArrivalTime: 25 Oct 2010 21:06:58.0624 (UTC) FILETIME=[8FBF3C00:01CB7488]
X-SEM-PROCESSED: 1

--0-600182225-1288026414=:59149
Content-Type: text/plain;
      charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

--0-600182225-1288026414=:59149
Content-Type: text/html;
      charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


--0-600182225-1288026414=:59149--

PLEASE HELP!!!!!!!!
:)
Thanks,
Bob
Hi all. I switched to a Cisco ASA using transpartent tunneling and that seemed to fix the problem. I can be 100% the network was the issue but that all that I can go on and all the help that I can give.

Going to close out the ticket now.

Thanks all for your help.

-Bob

Author

Commented:
less then an A because I couldnt find a true issue to the problem just a meriad of hopeful fixes that came down to a network issue. Probably.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial