troubleshooting Question

delivered mail time in inbox differ than the sent time of message

Avatar of omzeyad
omzeyad asked on
ExchangeEmail Protocols
3 Comments1 Solution759 ViewsLast Modified:
a mail is  displyed  in inbox to bedelivered at 10:30 AM,but when you open the mail it is displayed that it was sent at 10:16 .


check the header:i found that exanpcn27.arinc.com received the mail at 10:16:00 am
and we received from it 10:30 i don;t know what cause that delay

Received: from exanpcn27.arinc.com (144.243.3.28) by server.mydomaindc.local
 (1.1.1.1) with Microsoft SMTP Server id 14.1.323.3; Mon, 13 Feb 2012
 10:30:00 +0200
X-AuditID: 90f3031b-b7c9fae00000126e-79-4f38c6c4da27
Received: from EXANPCH2.arinc.com ( [10.243.77.162])      by exanpcn27.arinc.com
 (Symantec Brightmail Gateway - OUT) with SMTP id 99.32.04718.4C6C83F4; Mon,
 13 Feb 2012 03:16:04 -0500 (EST)
Received: from EXLONCH1.arinc.com (10.244.27.6) by EXANPCH2.arinc.com
 (10.243.77.162) with Microsoft SMTP Server (TLS) id 14.1.270.1; Mon, 13 Feb
 2012 03:16:03 -0500
Received: from EXLONMB1.arinc.com ([fe80::a1e9:a6b4:e5ff:ad74]) by
 EXLONCH1.arinc.com ([fe80::319d:44d2:445f:263f%13]) with mapi id
 14.01.0270.001; Mon, 13 Feb 2012 08:16:02 +0000
From: "Khaled, Rakan  (RKHALED)" <RKHALED@arinc.com>
To: "'T3_HD@mydomain.com.eg'" <T3_HD@mydomain.com.eg>
Subject: Re: Daily Report Of 12/2/2012
Thread-Topic: Daily Report Of 12/2/2012
Thread-Index: AQHM6ie5HNMQgcben0qA32RADSf/Nw==
Date: Mon, 13 Feb 2012 08:16:02 +0000
Message-ID: <539A39E9665E1E458C19A3802B927C18096A997E@EXLONMB1.arinc.com>
In-Reply-To: <E6C58BDD6D13874BA0D6EBB65611C7C91E6B86E6@SRVMBX02.mydomaindc.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.244.27.14]
Content-Type: multipart/alternative;
      boundary="_000_539A39E9665E1E458C19A3802B927C18096A997EEXLONMB1arincco_"
MIME-Version: 1.0
Return-Path: RKHALED@arinc.com
X-Brightmail-Tracker: AAAAAA==
X-MS-Exchange-Organization-AuthSource: server.mydomaindc.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: arinc.com
X-MS-Exchange-Organization-SenderIdResult: Pass
Received-SPF: Pass (server.mydomaindc.local: domain of RKHALED@arinc.com
 designates 144.243.3.28 as permitted sender) receiver=server.mydomaindc.local;
 client-ip=144.243.3.28; helo=exanpcn27.arinc.com;
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Organization-Antispam-Report: v=1.1
 cv=e/Scyw2KjX1ZNjF7DNsEWIMuRCl4A/Kn94ZETppegK0= c=1 sm=1 a=GsxhPIOTavcA:10
 a=9itXFh4srh0A:10 a=Ruw4dWQ4ADgA:10 a=xqWC_Br6kY4A:10
 a=kMn7lN4z5qE9qWBNzeEW5Q==:17 a=oJjaSD_AAAAA:8 a=gQDdYs7qAAAA:8
 a=MTsngMcPvkNd1K4fUPgA:9 a=3Eu8J26xtx68O8I6jIUA:7 a=QEXdDO2ut3YA:10
 a=z601itH5dksA:10 a=-_2Al94rAwUdXlNk:21 a=Wu3yC7_D-N22oKRM:21
 a=fGvBHG1KZaq_bMt3_sMA:9 a=NmTrgccs4qcYl-shZRIA:7 a=_W_S_7VecoQA:10
 a=frz4AuCg-hUA:10 a=kMn7lN4z5qE9qWBNzeEW5Q==:117;OrigIP:144.243.3.28;SCL:-1
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0

also I checked receive connector log for this message I found that :

2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F4,0,1.1.1.1:25,144.243.3.28:52156,+,,
2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F4,1,1.1.1.1:25,144.243.3.28:52156,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F4,2,1.1.1.1:25,144.243.3.28:52156,>,"220 server.mydomaindc.local Microsoft ESMTP MAIL Service ready at Mon, 13 Feb 2012 10:29:58 +0200",
2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F5,0,1.1.1.1:25,144.243.3.28:44268,+,,
2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F5,1,1.1.1.1:25,144.243.3.28:44268,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2012-02-13T08:29:59.347Z,server\Default server,08CEAD9222D601F5,2,1.1.1.1:25,144.243.3.28:44268,>,"220 server.mydomaindc.local Microsoft ESMTP MAIL Service ready at Mon, 13 Feb 2012 10:29:58 +0200",
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,3,1.1.1.1:25,144.243.3.28:44268,<,EHLO exanpcn27.arinc.com,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,4,1.1.1.1:25,144.243.3.28:44268,>,250-server.mydomaindc.local Hello [144.243.3.28],
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,5,1.1.1.1:25,144.243.3.28:44268,>,250-SIZE,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,6,1.1.1.1:25,144.243.3.28:44268,>,250-PIPELINING,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,7,1.1.1.1:25,144.243.3.28:44268,>,250-DSN,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,8,1.1.1.1:25,144.243.3.28:44268,>,250-ENHANCEDSTATUSCODES,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,9,1.1.1.1:25,144.243.3.28:44268,>,250-STARTTLS,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,10,1.1.1.1:25,144.243.3.28:44268,>,250-X-ANONYMOUSTLS,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,11,1.1.1.1:25,144.243.3.28:44268,>,250-AUTH NTLM,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,12,1.1.1.1:25,144.243.3.28:44268,>,250-X-EXPS GSSAPI NTLM,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,13,1.1.1.1:25,144.243.3.28:44268,>,250-8BITMIME,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,14,1.1.1.1:25,144.243.3.28:44268,>,250-BINARYMIME,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,15,1.1.1.1:25,144.243.3.28:44268,>,250-CHUNKING,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,16,1.1.1.1:25,144.243.3.28:44268,>,250-XEXCH50,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,17,1.1.1.1:25,144.243.3.28:44268,>,250-XRDST,
2012-02-13T08:29:59.503Z,server\Default server,08CEAD9222D601F5,18,1.1.1.1:25,144.243.3.28:44268,>,250 XSHADOW,
2012-02-13T08:29:59.659Z,server\Default server,08CEAD9222D601F5,19,1.1.1.1:25,144.243.3.28:44268,<,MAIL FROM:<RKHALED@arinc.com>,
2012-02-13T08:29:59.659Z,server\Default server,08CEAD9222D601F5,20,1.1.1.1:25,144.243.3.28:44268,*,08CEAD9222D601F5;2012-02-13T08:29:59.347Z;1,receiving message
2012-02-13T08:29:59.659Z,server\Default server,08CEAD9222D601F5,21,1.1.1.1:25,144.243.3.28:44268,>,250 2.1.0 Sender OK,
2012-02-13T08:29:59.831Z,server\Default server,08CEAD9222D601F5,22,1.1.1.1:25,144.243.3.28:44268,<,RCPT TO:<T3_HD@mydomain.com.eg>,
2012-02-13T08:29:59.831Z,server\Default server,08CEAD9222D601F3,27,1.1.1.1:25,58.185.112.251:47848,>,503 5.5.2 Need rcpt command,
2012-02-13T08:30:00.034Z,server\Default server,08CEAD9222D601F5,23,1.1.1.1:25,144.243.3.28:44268,>,250 2.1.5 Recipient OK,
2012-02-13T08:30:00.191Z,server\Default server,08CEAD9222D601F5,24,1.1.1.1:25,144.243.3.28:44268,<,DATA,
2012-02-13T08:30:00.191Z,server\Default server,08CEAD9222D601F5,25,1.1.1.1:25,144.243.3.28:44268,>,354 Start mail input; end with <CRLF>.<CRLF>,
2012-02-13T08:30:01.019Z,server\Default server,08CEAD9222D601F6,0,1.1.1.1:25,212.103.160.155:34016,+,,
2012-02-13T08:30:01.019Z,server\Default server,08CEAD9222D601F6,1,1.1.1.1:25,212.103.160.155:34016,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2012-02-13T08:30:01.019Z,server\Default server,08CEAD9222D601F6,2,1.1.1.1:25,212.103.160.155:34016,>,"220 server.mydomaindc.local Microsoft ESMTP MAIL Service ready at Mon, 13 Feb 2012 10:30:00 +0200",
2012-02-13T08:30:01.394Z,server\Default server,08CEAD9222D601F3,28,1.1.1.1:25,58.185.112.251:47848,<,RSET,
2012-02-13T08:30:01.394Z,server\Default server,08CEAD9222D601F3,29,1.1.1.1:25,58.185.112.251:47848,*,Tarpit for '0.00:00:05',
2012-02-13T08:30:04.659Z,server\Default server,08CEAD9222D601F5,26,1.1.1.1:25,144.243.3.28:44268,*,Tarpit for '0.00:00:03.718' due to 'DelayedAck',Delivered
2012-02-13T08:30:04.659Z,server\Default server,08CEAD9222D601F5,27,1.1.1.1:25,144.243.3.28:44268,>,250 2.6.0 <539A39E9665E1E458C19A3802B927C18096A997E@EXLONMB1.arinc.com> [InternalId=105425] Queued mail for delivery,
2012-02-13T08:30:06.409Z,server\Default server,08CEAD9222D601F3,30,1.1.1.1:25,58.185.112.251:47848,>,250 2.0.0 Resetting,
2012-02-13T08:30:06.409Z,server\Default server,08CEAD9222D601F3,31,1.1.1.1:25,58.185.112.251:47848,<,QUIT,
2012-02-13T08:30:06.409Z,server\Default server,08CEAD9222D601F3,32,1.1.1.1:25,58.185.112.251:47848,>,221 2.0.0 Service closing transmission channel,
2012-02-13T08:30:06.409Z,server\Default server,08CEAD9222D601F3,33,1.1.1.1:25,58.185.112.251:47848,-,,Local
2012-02-13T08:30:09.831Z,server\Default server,08CEAD9222D601F5,28,1.1.1.1:25,144.243.3.28:44268,<,QUIT,
2012-02-13T08:30:09.831Z,server\Default server,08CEAD9222D601F5,29,1.1.1.1:25,144.243.3.28:44268,>,221 2.0.0 Service closing transmission channel,
2012-02-13T08:30:09.831Z,server\Default server,08CEAD9222D601F5,30,1.1.1.1:25,144.243.3.28:44268,-,,Local
2012-02-13T08:30:49.940Z,server\Default server,08CEAD9222D601F6,3,1.1.1.1:25,212.103.160.155:34016,-,,Remote


the question here in this log why the remte IP changed from 144.243.3.28 to 58.185.112.251  when asking for rcpt command as shown below

RCPT TO:<T3_HD@mydomain.com.eg>,
2012-02-13T08:29:59.831Z,server\Default server,08CEAD9222D601F3,27,1.1.1.1:25,58.185.112.251:47848,>,503 5.5.2 Need rcpt command,
2012-02-13T08:30:00.034Z,server\Default server,08CEAD9222D601F5,23,1.1.1.1:25,144.243.3.28:44268,>,250 2.1.5 Recipient OK,


after that mail another mail from the same sender is received with time 11:05 at inbox but when you open it it is displayed that it was sent on 10:11

can someone explin to me why this delay is occured ,why I receive mail after 55 minutes

the header display that it is delivered to me at 11:05

also check the receive smtp log,it displayed that it is delivered at 9:05 am (utc time)which equal to 11:05 am egypt local time I think that proves that the delay is from their side
ASKER CERTIFIED SOLUTION
Senthil Kumar

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 3 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros