Missing Email - Exchange 2003

Posted on 2012-08-23
Last Modified: 2014-08-12
Hello Experts,

We have a user that reported a missing email from 20 days ago.  Our message tracking is set for 14 days so we aren't able to trace it.  What we do have are the smpt logs.  Looking at the log i found the transmission of the message in question, but it looks to be incomplete.   The transmission includes a successful ehlo, mail from, and rcpt to, but I don't see a data command or a quit command, which i suspect is the culprit of either the sending service or exchange.  could anyone shed some light on this for me? how could a transmission be missing a quit message.  from what i gather, even a reset of a connection should have at least a quit ???

2012-07-31 03:00:26 SMTPSVC1 xxxxxx 0 EHLO - 250 0 325 27 0 SMTP - - - -
2012-07-31 03:00:26 SMTPSVC1 xxxxx 0 MAIL - +FROM:<> 250 0 45 46 0 SMTP - - - -
2012-07-31 03:00:26 SMTPSVC1 xxxx 0 RCPT - +TO:<> 250 0 39 57 0 SMTP - - - -
Question by:sguido
    1 Comment
    LVL 63

    Accepted Solution

    Increase the tracking log period to 30 days or more to cover yourself...
    Although if the message wasn't delivered then it wouldn't be in tracking anyway.

    What you have seen is quite normal if the connection wasn't terminated correctly. I have seen firewalls do this, the PIX is notorious for it. AV can also do the same thing, McAfee has an SMTP scanning feature that has produced similar results.


    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    Suggested Solutions

    Create high volume marketing opportunities using email signatures with these top 10 DOs and DON'Ts of email signature marketing.
    Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
    The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now