Solved

How can I find out why an email was delayed in Exchange 2010

Posted on 2013-05-16
10
857 Views
Last Modified: 2013-05-29
We had some very important emails that were time sensitive sent out yesterday, 4 in all. the one we set out at about 5pm somehow sat in Exchange until 100 am this morning. Message tracking shows:

Delivery Report for  email


Submitted
5/15/2013 5:14 PM our.server.com
The message was submitted to our.server.com.

Transferred
5/16/2013 11:04 AM our.server.com
The message was successfully handed off to a different e-mail system. This is as far as we can track it.

Not sure if I'm using Message Tracking right, but all the steps show a time stamp of 2013/05/15 17:14:10

Is there a place to look to see why it was delayed? The Execs aren't happy and want answers  I can't give.

Thanks!
0
Comment
Question by:canuseeit
  • 3
  • 2
  • 2
  • +3
10 Comments
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39173029
If you can get the Original email from the Recipients system and check the Header of the Email it will tell you exactly where if so the delay happened with TIme zone and everything

- Rancy
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39173030
0
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39173063
Check the application/system logs on the Exchange servers during that time if you believe the delay was on Exchange servers. If you find any errors there then you could work from there to find the root cause.
0
 
LVL 4

Expert Comment

by:mouseware
ID: 39173070
You'll need to look through your SMTP logs (assuming you have logging enabled) and find that message. You should see the reason for the delay or failure. It could have been submitted on time, but there were failures out of your organization's control that prevented the message from reaching the recipient. Basicly you are looking for SMTP errors from 5PM to 11AM the following day for that message ID or recipient which indicate why it took so long to send. YOu may find something like recipient's server not responding/timeout/busy/etc.
0
 

Author Comment

by:canuseeit
ID: 39173324
The issue was it was an PR annoucment to our customers, so it was a long list of 200 contacts all in the bcc. The first 3 were only to about 50 email addresses and all went without a hitch. The last one we sent got delayed.

I am checking the logs now, I will report back to see if there is something there I don't understand.

For Rancy, I'm not going to post the entire thing, but here is the part from when I sent it, and the next part that is 18 hours later

Received: from mail.ourserver.com (ip.add.re.ss) by CO9EHSMHS002.bigfish.com
 (10.236.130.12) with Microsoft SMTP Server id 14.1.225.23; Thu, 16 May 2013
 18:06:15 +0000
Received: from mail.ourserver.com ([::1]) by mail.ourserver.com ([::1]) with
 mapi id 14.01.0421.002; Wed, 15 May 2013 17:14:10 -0700
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 

Author Comment

by:canuseeit
ID: 39173328
unfortunetly I am stupid andout logging is only goes back to yesterday at 10:48pm... sigh
0
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39173343
Uhhh :( Just wondering if there is a way out to find a root cause without logs. Have you checked that on all servers involved?
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39173382
Received: from mail.ourserver.com ([::1]) by mail.ourserver.com ([::1]) with
 mapi id 14.01.0421.002; Wed, 15 May 2013 17:14:10 -0700

Are both servers in Question the same or different ones ?

- Rancy
0
 
LVL 4

Accepted Solution

by:
Jeffery Hayes earned 395 total points
ID: 39173586
Received: from mail.ourserver.com (ip.add.re.ss) by CO9EHSMHS002.bigfish.com
 (10.236.130.12) with Microsoft SMTP Server id 14.1.225.23; Thu, 16 May 2013
 18:06:15 +0000
Received: from mail.ourserver.com ([::1]) by mail.ourserver.com ([::1]) with
 mapi id 14.01.0421.002; Wed, 15 May 2013 17:14:10 -0700

Bigfish would be forefront which is the Edge filter.

Look at the complete message Header's and see if there is any antivirus that is touching the mail. The delay occurs between when your server sends out the message externally and to the edge filter.

Other things to check is that this could have simply been due to message queuing as I understand that the message was sent to many recipients.
0
 

Author Closing Comment

by:canuseeit
ID: 39205959
Correct we use Forefront protection. That is where the item got stuck, even though I have forefront turned OFF for outgoing mail. There is nothing except a delay leaving there. there is no other error, so I opened a ticket with Microsoft on this.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now