External Email Delayed before hitting our email severs

Posted on 2013-11-27
Last Modified: 2014-11-12
This is odd. We have clients that use Gmail, yahoo etc., to send us email and recently there has been a major delay.
We checked the MessageTrackinglog and see no issue when the email actually hits our sever it is delivered quickly.
Tested with a Gmail account and it took 3 hours before reaching our server. Ensured Namservers, NS Records, MX records, DNS, SOA record, and all other connections for us are correct. We use Nettica as our host for DNS and their support tested all the MX and nameservers as well with no issue.
When we sent test with Hotmail it went through in 8 seconds and Gmail 3 hours, Yahoo 1 hour, and client specific email domains ranged from no is in seconds to others delayed over 4 hours.
Has anyone ever seen such a thing. I am at a dead end. I know it isn't our server, or DNS host but what else is there.

Please Please Please Help me.

Question by:kryanC
  • 2
  • 2
  • 2
LVL 18

Expert Comment

by:Andrew Davis
ID: 39682904
do you have any inline spamfiltering that utilizes grey listing?

The reason for this is that GMail and yahoo, do not retry with the same server, thus they can fail grey listing, eventually the same server may try twice in the time frame so it will get added.

Basically Grey Listing is a method that looks at the IP of the server sending a message and Refects it with a message to try again in x Seconds (300 = 5 minutes), then the server must keep trying to connect for that period and if it does the servers IP gets added to the allowed IP address list for y period (ussually 12 months).

The problem is that after the first reject, Gmail and Yahoo, do not process the subsequent attempts with the same server (Its random, so sometimes it may). This means that it can take a long time to add there IP to the allowed list.

For your information
Below are the SPF records for Gmail, They list Thousands of IP addresses that Email can from, anyones guess how many they actually have.

11/27/13 00:24:43:051 -- (9160) found SPF record for v=spf1 ip4: ip4: ~all
11/27/13 00:24:43:114 -- (9160) found SPF record for v=spf1 ~all
11/27/13 00:24:43:160 -- (9160) found SPF record for v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all

LVL 63

Accepted Solution

Simon Butler (Sembee) earned 500 total points
ID: 39684005
The header is the key thing here as well. That will show you where the delay took place.
Greylisting is the most likely cause, if you are using a third party spam tool that is. Exchange doesn't do it on its own.


Author Comment

ID: 39698240
Sorry for the delay have been out of country. I will look into the grey listing but to be clear. Grey listing can cause the delay before ever reaching our Exchange?
Just trying to wrap my head around how to troubleshoot something I can't touch. Sorry to be so dim on this process, any added info on how to resolve/test would be appreciated.
We are not using any third party spam filtering either.

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39699736
Until the message hits your server is not under your control. That is the key thing here as it will tell you where the delay occurred. Until you know that you don't know if the problem is yours or not.

LVL 18

Expert Comment

by:Andrew Davis
ID: 39699777
Grey listing can cause the issue, but it is not a feature of exchange, so it would have to be coming implemented in a gateway filter.

What Simon is saying above is 100% correct.
The first thing to look at is the headers of a delayed message.

To get the headers may be different in different client versions but for outlook 2010:-
Open message > File > Properties.

If you could post back a copy of the headers then we may be able to assist.


Author Comment

ID: 39701321
Thank you all very much. I have gone through the header line by line and see a delay between the sender and my server. Have now shared this info with the Senders IT to see if they can find anything there side. I did notice they also used some IronPort cofigs their end before sending.
Maybe this can cause a delay?

Thanks again and will close this once I get confirmation from their side. If any other ideas come to mind, please share.


Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
This Micro Tutorial demonstrates how to quickly find related content for YourTango's posts using MozBar Chrome extension.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now