sbs2008 mail from certain external domains delayed

The only real way to see where the delay occurs is to look at the email headers once the email arrives and examine them to see where the delay occurred.

Do you receive mail directly to your server or via a 3rd party who cleans and passes the mail on to you?

directly - we have an mx pointing to the external address of our router - all std sbs ports forwarded in.  I've run MXtoolbox and TestExchangeConnectivity tools - all appear fine.

seems to be random domain names, comcast is one.  checking on the headers.....

dsl  1.5mb-down, 768kb-up

as part of troubleshooting, i've uninstalled forefront, i've set SCL from 7 to 6 in Org Config | Hub Transport | Content Filtering

Okay - any email headers available?

I think I found the issue; i turned on smtp logging on the recv connector (EMC | Server Cfg | Hub Transport).  I discovered a bunch of 421 4.3.2 Service not available messages -from there i looked more closely at the SBS connector, it's address range was incorrectly set to 192.168.0.0-192.168.0.0 (the router is at 192.168.0.1).  The Default connector *was* properly set.  I went ahead and changed it, now mail appears to be flowing from all domains.

I'm still a bit mystified why this problem suddenly occured, although i don't specifically remeber changing any settings on the receive connectors (I tend to run the wizards on SBS - this from hard experience), I'll chalk it to that

thanks alan for your lightening quick responses!  you got me pointed in the right direction.....

Glad you are sorted and yes - it's a bit of a mystery.  Glad that I helped steer you in the right direction.  Sounds like someone has been playing!

Don't forget to close the question down.

Alan

Problem Solved!  As it turns out it was a Qwest branded Actiontech M100 DSL modem that was causing the issue.  Going through the SMTP logs on the server revealed:

MAIL FROM:<rapl****@comcast.net> SIZE=123982,
receiving message
250 2.1.0 Sender OK,
RCPT TO:<of****@cookshillcc.org>,
250 2.1.5 Recipient OK,
DATA,
354 Start mail input; end with <CRLF>.<CRLF>,
451 4.7.0 Timeout waiting for client input,

Again, only certain domains affected.  I've used a number of the DSL modems, but in all other cases, have DMZ'd all traffic to a Cisco Pix or Sonicwall.  In this case I implemented Port Forwarding - it looks like traffic on 25 was just getting dropped.......

I substituted a different make of DSL modem - things seem to be working perfectly
 

ultimately caused by qwest actiontech DSL modem dropping forwarded traffic on port 25

Oh what fun - hardware messing about.  Glad you sorted the problem and thanks for the points.

Alan