Exchange 2010 - Incoming emails issue

You mean during 10 hours, there is no email from external to your organization but you can send email to external and within internally.

Could you confirm that the email in user's outlook, it is from external, internal?

You can check the email internet header to verify the incoming source.

Yes I can confirm that the email in users outlook is from internal during this time.
I can confirm there was no email incoming from external to my orgnanisation during this 10 hours. users can send and receive internal emails and access them through outlook clients throughout this outage window.

Thank you Suriyaehnop for your assistance.

do you have a designated smtp spam filter server? iron port? proofpoint? Symantec cloud?

or you use your exchange facing public directly???

sounds like a network issue more than exchange issue.

Yes Justin -
we have designated spam filter - external service provider our mx record is pointed to that. Once the spam emails are filtered our emails hit exchange 2010 server.

They have washed their hands off saying no issues on their end. And they have advised us to check our exchange server. Problem is where to check the historical queue if any as currently the emails are flowing properly.

I need detailed steps in "how & where "to go and check the logs.

Thanks for your suggestion.

You need to look at the headers of one of the delayed messages - that will show you where the delay occurred. Once you know where the delay occurred then you can investigate further.

Simon.

Thank you Simon,
Please see below for an email header actual email hit outlook 10:36 am ( Australia - Melbourne Time)
Where was the delay spam filter to exchange ( or ) exchange to outlook ? How long this email was sitting in spam filter queue waiting for delivery. When the email was delivered at 10:36 am it still had original timestamp on outlook (07:23 am) . Please help.



Received: from smtp-01.micron21.com (119.31.226.100) by EDLYNEXCH.edlyn.com.au
 (192.168.0.32) with Microsoft SMTP Server id 14.1.438.0; Tue, 21 Jul 2015
 07:23:05 +1000
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AtIAAFdlrVVgLx5GlGdsb2JhbABcgkaBIWmDHwOpdZArIAELhTVHASeBDUwBAQEBAQESAQEBAQkJCwkfMIQ5ARMKEwMBCgMaDwEzAiYCMw8JARsLGQQEiA0NsgIBAW+EawKBXQ2PeQEGgSIUji4KAREBBmiCUhKBMZRXAW0Cg3+IdYcIgUABixqDYYFvCwEBAYJBIjGBDYE+AQEB
X-IronPort-AV: E=Sophos;i="5.04,848,1406556000";
   d="scan'208,217";a="35118974"
Received: from techtarget.outbound.ed10.com ([96.47.30.70])  by
 mx-01.micron21.com with ESMTP; 21 Jul 2015 07:23:04 +1000
Return-Path: <XHY8ZX0-AMK26J-2OLY7A-17IVVS-0600I1-H-M2-20150720-8a9a22c89f07a1@techtarget.bounce.ed10.net>
DKIM-Signature: v=1; a=rsa-sha1; d=ed-email.techtarget.com; s=ED-DKIM-V3; c=relaxed/relaxed;
      q=dns/txt; i=@ed-email.techtarget.com; t=1437427382;
      h=From;
      bh=hM2KcBUeIawoZM736whUlop4UBA=;
      b=a296VDX1Wh7VDhZnfGImMAIxPo+bgqGRRqpRWB7uHGPWo1eE+4Gb8zDFITRMw3x8
      cCfuoARBeJwE3who2nDUUsXjZ4iVkbCoeyPRtxAHPcmWSNFVJXrCXfwOuzTO1YT0
      qIMx6aomGwEXXNIO2fsH/cxAHXspWwjmrVo9XnlTafI=;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
      s=ED2011-02; d=ed-email.techtarget.com;
      h=Received:Date:Content-Type:Content-Transfer-Encoding:MIME-Version:From:Reply-To:To:Subject:Message-Id:X-Mail-From:X-Match:X-RCPT-To:X-Mailer;
      b=f70fRnpft0hVQfKakHQ7YOk9chbvIpWUzOAYmX4cCiLoXbOi+6Cu4Vg03qJOAo0+
      oWnb10zmnZAI7Siw+rw0EOZAsgjf5tGhwcYOr4+trYtCaVM5gApzuBS4IpE74y8d
Received: from [127.0.0.1] ([127.0.0.1:37709])      by bm1-22.bo3.e-dialog.com
 (envelope-from
 <XHY8ZX0-AMK26J-2OLY7A-17IVVS-0600I1-H-M2-20150720-8a9a22c89f07a1@techtarget.bounce.ed10.net>)
      (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM      id 3F/3E-27069-6B66DA55; Mon, 20
 Jul 2015 17:23:02 -0400
Date: Mon, 20 Jul 2015 17:23:02 -0400
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
From: SearchNetworking.com <info@ed-email.techtarget.com>
Reply-To: SearchNetworking.com <info@ed-email.techtarget.com>
To: <hsiva@edlyn.com.au>
Subject: Expert e-guide: Migrate from Windows Server 2003
Message-ID: <16475-846-XHY8ZX0-AMK26J-2OLY7A-17IVVS-0600I1-H-M2-20150720-8a9a22c89f07a1@e-dialog.com>
X-Mail-From: XHY8ZX0-AMK26J-2OLY7A-17IVVS-0600I1-H-M2-20150720-8a9a22c89f07a1@techtarget.bounce.ed10.net
X-Match: techtarget.bounce.ed10.net
X-RCPT-To: hsiva@edlyn.com.au
X-Mailer: EDMAIL R6.00.02
X-MS-Exchange-Organization-AuthSource: EDLYNEXCH.edlyn.com.au
X-MS-Exchange-Organization-AuthAs: Anonymous

Thank you Simon & Murali.

We have not altered the message posted above. We have just copied and pasted information from outlook as it is.

During this time the messages were not available in OWA as well. There was a flush of email from 10:36 am to our outlook emails. We called the Spam filtration company ( external ) tech support at 10:35 am. immediately emails were released. It cannot be a coincidence.
Please see attached file for logs from spam filter company. I have changed Ip addresses and email addresses as they are sensitive in nature. all other remains unchanged.

outage time 12:05 am to 10:36 am.

Thank you
Harry S
spam-filter-log.txt

We spoke to the spam filter company and the issue seems to be on their end.
Thank you for your suggestions and help.
Regards
Harry S