Exchange 2010 Mail Relay Issue

I have a pretty simple configuration with 2 Exchange 2010 servers (each at Rollup 6 SP1 running under Windows 2008 R2 in a single forest/domain) in a DAG configuration.  They're in different subnets with the primary server located in headquarters connected to the Internet and the secondary server in a branch office just used as a passive backup.  Before applying MS patches this weekend to the passive server, everything was working fine.  However after the patches, now whenever any mail reaches my primary server (on which all mailboxes are defined), the mail for some reason is being routed to the passive server and just sitting in the queue and going nowhere.  I can fix the problem by merely turning down the Exchange services on the passive server and everything works again.  What is possibly wrong and where do I go to troubleshoot this?

I've turned on logging and have looked through the logs but haven't seen anything that says there's a problem.  I ran two tests for sending outbound mail:
                       . Outlook - mail left my mailbox and shows up in the passive server queue
                       . test-mailflow  cmdlet from the active mail server which comes back with TestMailFlowResult: *Failure*

Again, after turning down the Exchange services on the secondary/passive server, mail goes out successfully on both tests.

I checked my Autodiscover under Outlook and it shows me connected to my primary server (I thought somehow I was being directed to the passive server but that isn't the case).  

The only other change I am aware of from this weekend is a change in the network architecture.  The passive server was in a subnet connected via a  T1 circuit back to headquarters but now it's connected via a VPN back to headquarters.  I don't think that should have anything to do with it.  

Thanks for any assistance!!!
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

This is by design. if you have DAG with hub role installed and also another dag member with hub role on it [be it passive] mails will go to the other hub.
That is one reason why Microsoft recommends to have Hub server on a different dedicated machine.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ejefferson213Author Commented:
VERY interesting!  Thanks for your reply.  I didn't mention that both my servers are essentially identical but you picked up on that; each has a mailbox and hub role.  Also I'm not using EdgeSync server, we're using our hub server for Internet based mail.  (I know it's not ideal but we're a small non-profit with not a lot of money for machines.)  So the mail I was referring to is mail to go to the Internet but based on the article you sent, it doesn't matter. Mail will still route through my "passive" DAG member.  

Therefore, I must have something configured improperly because it's not sending the mail back to the primary server that has access to the Internet.  The send connector on the hub transport of my secondary/passive server has the Source Server set to my primary server.  Since this secondary server has no Internet access, should I set the send connector of this server to use the Smart Host and point it to my primary server?
Ensure Business Longevity with As-A-Service

Using the as-a-service approach for your business model allows you to grow your revenue stream with new practice areas, without forcing you to part ways with existing clients just because they don’t fit the mold of your new service offerings.

Yes i know. its very interesting and most of the people get confused on mail flow on DAG.

Just add both the servers as source server on the send connector. Once done restart the transport server.
ejefferson213Author Commented:
Sorry for the delay.  I'll test this solution tomorrow morning and post back the results.  Thank you very much for your assistance.
ejefferson213Author Commented:
Hopefully I did this right.  I added both servers as the source server on the secondary Exchange server and specified the primary (internet facing) exchange server as the smarthost to the secondary server and then restarted the transport service on the secondary server. Unfortunately, mail submitted by an outlook client was received by the primary server and placed in the queue on the secondary server and never went out.  It had a delivery type of Smarthost connector delivery.  Is there something else I'm missing or didn't do?   Thank you!
so you mean you created a send connector between two hub servers ?
ejefferson213Author Commented:
I changed my send connector on my secondary server to indicate a smarthost was involved and pointed it to my primary server resulting in mail ending up in the secondary queue and going nowhere (unless I didn't wait long enough ~5 minutes).  Anyway, trying to be clever, I stopped the transport service and left all other services running and mail proceeded to go in and out of the primary server normally as before.  After restarting replication (mailbox copy) between the two servers, which succeeded, I was suddenly made aware that people were getting "Delivery Delayed" emails. Looking, I saw that messages were accumulating, this time in my primary server.  Having subjected my staff to issues before, I shutdown all email services on the secondary server and the mail in the queue went out.  So I'll leave these services down on my secondary server until I can get this fixed.
ejefferson213Author Commented:
Thank you for explaining how mail flows with DAG; the reference to the article was very helpful.  Although I don't have it working yet, I'm sure I'll be able to get the right configuration in place to get this to work.  Thanks again.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.