Exchange 2010 - Incoming emails issue

Dear All,
Our Organisation haven't received emails for 10 hours and suddenly all the users started receving emails on their outlook with original time stamps. How to find the source of the problem? Is there a log to inspect incoming email queue? Currently there is no emails waiting on the queue to be delivered to user mailbox.

During the 10 hours we can send emails to external parties. We also can send/receive emails internally.

Please help.
Thank you
Harry S
Hariharan SivakumarIT ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You mean during 10 hours, there is no email from external to your organization but you can send email to external and within internally.

Could you confirm that the email in user's outlook, it is from external, internal?

You can check the email internet header to verify the incoming source.
Hariharan SivakumarIT ManagerAuthor Commented:
Yes I can confirm that the email in users outlook is from internal during this time.
I can confirm there was no email incoming from external to my orgnanisation during this 10 hours. users can send and receive internal emails and access them through outlook clients throughout this outage window.

Thank you Suriyaehnop for your assistance.
Justin YeungSenior Systems EngineerCommented:
do you have a designated smtp spam filter server? iron port? proofpoint? Symantec cloud?

or you use your exchange facing public directly???

sounds like a network issue more than exchange issue.
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

Hariharan SivakumarIT ManagerAuthor Commented:
Yes Justin -
we have designated spam filter - external service provider our mx record is pointed to that. Once the spam emails are filtered our emails hit exchange 2010 server.

They have washed their hands off saying no issues on their end. And they have advised us to check our exchange server. Problem is where to check the historical queue if any as currently the emails are flowing properly.

I need detailed steps in "how & where "to go and check the logs.

Thanks for your suggestion.
Simon Butler (Sembee)ConsultantCommented:
You need to look at the headers of one of the delayed messages - that will show you where the delay occurred. Once you know where the delay occurred then you can investigate further.

Hariharan SivakumarIT ManagerAuthor Commented:
Thank you Simon,
Please see below for an email header actual email hit outlook 10:36 am ( Australia - Melbourne Time)
Where was the delay spam filter to exchange ( or ) exchange to outlook ? How long this email was sitting in spam filter queue waiting for delivery. When the email was delivered at 10:36 am it still had original timestamp on outlook (07:23 am) . Please help.

Received: from ( by
 ( with Microsoft SMTP Server id 14.1.438.0; Tue, 21 Jul 2015
 07:23:05 +1000
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.04,848,1406556000";
Received: from ([])  by with ESMTP; 21 Jul 2015 07:23:04 +1000
Return-Path: <>
DKIM-Signature: v=1; a=rsa-sha1;; s=ED-DKIM-V3; c=relaxed/relaxed;
      q=dns/txt;; t=1437427382;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
Received: from [] ([])      by
      (ecelerity r(34222M)) with ECSTREAM      id 3F/3E-27069-6B66DA55; Mon, 20
 Jul 2015 17:23:02 -0400
Date: Mon, 20 Jul 2015 17:23:02 -0400
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
From: <>
Reply-To: <>
To: <>
Subject: Expert e-guide: Migrate from Windows Server 2003
Message-ID: <>
X-Mailer: EDMAIL R6.00.02
X-MS-Exchange-Organization-AuthAs: Anonymous
Murali ReddyExchange ExpertCommented:
Looks like you made some edits to the header. However looking at the header it looks like the message hea arrived at at Mon, 20  Jul 2015 17:23:02 -0400. And there is a hop/timestamp missing between and

Again the message arrived at on 21 Jul 2015 07:23:04 +1000, which shows a delay.

However with the missing information, We can't predict the exact delay, it could be at either one of the hosts arrival or dispatching.
Simon Butler (Sembee)ConsultantCommented:
Outlook shows the Sent time when you open the message, and then the received time in the message view. That is the same even if there is a delay.

I have to disagree with the assessment above. I don't see any delay in that message at all.
The email went through a bulk emailing system, which means most of the bottom part of the header is close to useless. The top part is key - where it shows that the email was delivered to Exchange shortly after it was sent.

This looks like the delay was internal.

I usually see that when Outlook is unable to communicate with Exchange correctly. The delayed message would be seen in OWA.

You now need to look at message tracking, see if you can find the message and whether there was a delay with delivery to the store. If the message was delivered to the store promptly then the issue is after delivery.

Hariharan SivakumarIT ManagerAuthor Commented:
Thank you Simon & Murali.

We have not altered the message posted above. We have just copied and pasted information from outlook as it is.

During this time the messages were not available in OWA as well. There was a flush of email from 10:36 am to our outlook emails. We called the Spam filtration company ( external ) tech support at 10:35 am. immediately emails were released. It cannot be a coincidence.
Please see attached file for logs from spam filter company. I have changed Ip addresses and email addresses as they are sensitive in nature. all other remains unchanged.

outage time 12:05 am to 10:36 am.

Thank you
Harry S
Simon Butler (Sembee)ConsultantCommented:
If all of the email came in shortly after the phone call to the filtering company, then that is the source of the problem, no matter what they may say.

Remember most service providers will lie about problems with their network or service. They do not want to admit there is a problem so will come up with any excuse. I did tech Support for two years - the first rule - find something else to blame the problem on.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Hariharan SivakumarIT ManagerAuthor Commented:
We spoke to the spam filter company and the issue seems to be on their end.
Thank you for your suggestions and help.
Harry S
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.