Not receiving mail from Google Apps\Gmail with attachments

It seems that all of the sudden receiving emails to my domain with attachments from Google Apps\Gmail has become an issue.  Emails without attachments come through without issue.

We internally host an Exchange server; Version: 14.02.0387.000.  

Here is the message I receive - it takes at least a day if not more to receive this:

This is an automatically generated Delivery Status Notification

THIS IS A WARNING MESSAGE ONLY.

YOU DO NOT NEED TO RESEND YOUR MESSAGE.

Delivery to the following recipient has been delayed:

     email@domain.com

Message will be retried for 2 more day(s)

Technical details of temporary failure:
Missed upload deadline (899.98s) (state SENT_MESSAGE)

----- Original message -----

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:date:message-id:subject:from:to:content-type;
        bh=pd4xo+IdJfT7G8lnJoJGj+XHf2VIoeULJJEwn9o2rzI=;
        b=zf8yEL7mQPugX0uAJ0gHRP9ZTVSq5YqcIv5EqQwp1Z799EDy8T5pxtaR5fXnBnXYXq
         bARu1lX+Q1UcwRQRjQX8PpBoRxveqYCizuvgiV5YqvCdHU3gHEFdmpk3J6BvOLB7LUR+
         bbAGFiLJMVcF/s2eO0mGSiR7U9ufKai/NaiwFgn7GlW7T+3FMzjCfwsfETD9q3dZ5CzT
         nuXg38oKFROsI0U6ZEOLNm33m5XUb5cOvdLVU/v5aKCWCXaWdkpKHZ0V84gb4+0vgEes
         jTFscmMP5q9OQJJWJuGXifk+CuuZNVlpjxngP2pWyuCkgltfqyWotbUq5/+dKR2gp6mI
         0E0g==
MIME-Version: 1.0
X-Received: by 10.28.129.131 with SMTP id c125mr9337825wmd.21.1447856547424;
 Wed, 18 Nov 2015 06:22:27 -0800 (PST)
Received: by 10.28.72.70 with HTTP; Wed, 18 Nov 2015 06:22:27 -0800 (PST)
Date: Wed, 18 Nov 2015 09:22:27 -0500
Message-ID: <CAHgc6WLsAt56hVsYUhLF+owAXfV=6DaN5Fjon1Y5OMRwXFFRPg@mail.gmail.com>
Subject: Attachment test from gmail
From: Christina Taylor <email@gmail.com>
To: Christina Taylor <email@domain.com>
Content-Type: multipart/mixed; boundary=001a114247f63450160524d15fa5

Other details that might help to diagnose; we have a WatchGuard firewall w\SMTP proxy and Trend Micro WFBA deployed.
Any help is greatly appreciated.
Christina TaylorIT AdministratorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jason CrawfordTransport NinjaCommented:
Are the emails sent using POP or IMAP?  Run a speedtest on your network (speedtest.net) and report the results.
0
BembiCEOCommented:
I guess you are no the only one...
See also his thread.....

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_28400676.html

Even other statements point to ISP or router issues.

You may enable the connection log and the SMTP Send/Receive logs in Exchange to confirm this.
It seems to be, that the connection is closed before exchange got the whole data part.
Also possible a performance issue or drop outs on the line.
At least you see the sequence in the log and here it breaks.

As I see this issue mostly with google mail, it may be also protocol related, If nothing helps, you may contact your ISP for further inspection.

Make sure Exchange is up to date,
Also inspect your routers firmware (if you can, try a different router)
1
Christina TaylorIT AdministratorAuthor Commented:
Thank you for your reply Bembi.  I've enabled logging and sent a few test messages with attachments.

Perhaps we can review the log to further diagnose the issue?  

The first log message is a successfully delievered email with (very small - 461KB) attachment :

2015-11-25T15:22:16.807Z,RODAN\Default RODAN,08D2EC01D1149441,19,10.0.0.242:25,74.125.82.46:34168,<,MAIL FROM: <email@gmail.com> SIZE=648518,
2015-11-25T15:22:16.807Z,RODAN\Default RODAN,08D2EC01D1149441,20,10.0.0.242:25,74.125.82.46:34168,*,08D2EC01D1149441;2015-11-25T15:22:16.604Z;1,receiving message
2015-11-25T15:22:16.807Z,RODAN\Default RODAN,08D2EC01D1149441,21,10.0.0.242:25,74.125.82.46:34168,>,250 2.1.0 Sender OK,
2015-11-25T15:22:16.901Z,RODAN\Default RODAN,08D2EC01D1149441,22,10.0.0.242:25,74.125.82.46:34168,<,RCPT TO: <email@domain.com>,
2015-11-25T15:22:20.239Z,RODAN\Default RODAN,08D2EC01D1149436,12,10.0.0.242:25,209.71.141.12:40912,*,Tarpit for '0.00:00:19.110' due to 'DelayedAck',Delivered
2015-11-25T15:22:20.239Z,RODAN\Default RODAN,08D2EC01D1149436,13,10.0.0.242:25,209.71.141.12:40912,>,250 2.6.0 <PTC_PROD_WEB_020.764373308403591@PTC_PROD_WEB_02> [InternalId=23575] Queued mail for delivery,
2015-11-25T15:22:20.255Z,RODAN\Default RODAN,08D2EC01D1149436,14,10.0.0.242:25,209.71.141.12:40912,<,QUIT,
2015-11-25T15:22:20.255Z,RODAN\Default RODAN,08D2EC01D1149436,15,10.0.0.242:25,209.71.141.12:40912,>,221 2.0.0 Service closing transmission channel,
2015-11-25T15:22:20.255Z,RODAN\Default RODAN,08D2EC01D1149436,16,10.0.0.242:25,209.71.141.12:40912,-,,Local
2015-11-25T15:22:21.253Z,RODAN\Default RODAN,08D2EC01D1149443,0,10.0.0.242:25,104.160.74.68:31978,+,,
2015-11-25T15:22:21.253Z,RODAN\Default RODAN,08D2EC01D1149443,1,10.0.0.242:25,104.160.74.68:31978,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2015-11-25T15:22:21.253Z,RODAN\Default RODAN,08D2EC01D1149443,2,10.0.0.242:25,104.160.74.68:31978,>,"220 RODAN.domain.com Microsoft ESMTP MAIL Service ready at Wed, 25 Nov 2015 10:22:20 -0500",

This one has not yet come through and I believe will ultimately fail due to size (2466KB):

2015-11-25T15:42:13.023Z,RODAN\Default RODAN,08D2EC01D114950E,19,10.0.0.242:25,74.125.82.48:34792,<,MAIL FROM: <email@gmail.com> SIZE=3458025,
2015-11-25T15:42:13.023Z,RODAN\Default RODAN,08D2EC01D114950E,20,10.0.0.242:25,74.125.82.48:34792,*,08D2EC01D114950E;2015-11-25T15:42:12.836Z;1,receiving message
2015-11-25T15:42:13.023Z,RODAN\Default RODAN,08D2EC01D114950E,21,10.0.0.242:25,74.125.82.48:34792,>,250 2.1.0 Sender OK,
2015-11-25T15:42:13.117Z,RODAN\Default RODAN,08D2EC01D114950E,22,10.0.0.242:25,74.125.82.48:34792,<,RCPT TO: <email@domain.com>,
2015-11-25T15:42:13.257Z,RODAN\Default RODAN,08D2EC01D114950E,23,10.0.0.242:25,74.125.82.48:34792,>,250 2.1.5 Recipient OK,
2015-11-25T15:42:13.694Z,RODAN\Default RODAN,08D2EC01D114950E,24,10.0.0.242:25,74.125.82.48:34792,<,BDAT 2705,
2015-11-25T15:42:13.756Z,RODAN\Default RODAN,08D2EC01D114950E,25,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:18.764Z,RODAN\Default RODAN,08D2EC01D114950E,26,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 2705 octets",
2015-11-25T15:42:18.764Z,RODAN\Default RODAN,08D2EC01D114950E,27,10.0.0.242:25,74.125.82.48:34792,<,BDAT 140894,
2015-11-25T15:42:18.764Z,RODAN\Default RODAN,08D2EC01D114950E,28,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:23.771Z,RODAN\Default RODAN,08D2EC01D114950E,29,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 140894 octets",
2015-11-25T15:42:23.771Z,RODAN\Default RODAN,08D2EC01D114950E,30,10.0.0.242:25,74.125.82.48:34792,<,BDAT 141024,
2015-11-25T15:42:23.771Z,RODAN\Default RODAN,08D2EC01D114950E,31,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:28.779Z,RODAN\Default RODAN,08D2EC01D114950E,32,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 141024 octets",
2015-11-25T15:42:28.779Z,RODAN\Default RODAN,08D2EC01D114950E,33,10.0.0.242:25,74.125.82.48:34792,<,BDAT 140946,
2015-11-25T15:42:28.779Z,RODAN\Default RODAN,08D2EC01D114950E,34,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:33.787Z,RODAN\Default RODAN,08D2EC01D114950E,35,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 140946 octets",
2015-11-25T15:42:33.787Z,RODAN\Default RODAN,08D2EC01D114950E,36,10.0.0.242:25,74.125.82.48:34792,<,BDAT 141024,
2015-11-25T15:42:33.787Z,RODAN\Default RODAN,08D2EC01D114950E,37,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:38.794Z,RODAN\Default RODAN,08D2EC01D114950E,38,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 141024 octets",
2015-11-25T15:42:38.794Z,RODAN\Default RODAN,08D2EC01D114950E,39,10.0.0.242:25,74.125.82.48:34792,<,BDAT 140634,
2015-11-25T15:42:38.794Z,RODAN\Default RODAN,08D2EC01D114950E,40,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:43.802Z,RODAN\Default RODAN,08D2EC01D114950E,41,10.0.0.242:25,74.125.82.48:34792,>,"250 2.6.0 CHUNK received OK, 140634 octets",
2015-11-25T15:42:43.802Z,RODAN\Default RODAN,08D2EC01D114950E,42,10.0.0.242:25,74.125.82.48:34792,<,BDAT 141024,
2015-11-25T15:42:43.802Z,RODAN\Default RODAN,08D2EC01D114950E,43,10.0.0.242:25,74.125.82.48:34792,*,Tarpit for '0.00:00:05',
2015-11-25T15:42:48.139Z,RODAN\Default RODAN,08D2EC01D114950F,0,10.0.0.242:25,192.28.146.19:45402,+,,
2015-11-25T15:42:48.139Z,RODAN\Default RODAN,08D2EC01D114950F,1,10.0.0.242:25,192.28.146.19:45402,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2015-11-25T15:42:48.139Z,RODAN\Default RODAN,08D2EC01D114950F,2,10.0.0.242:25,192.28.146.19:45402,>,"220 RODAN.domain.com Microsoft ESMTP MAIL Service ready at Wed, 25 Nov 2015 10:42:47 -0500",
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

BembiCEOCommented:
Hello,

first at all I would inspect now, if the time settings are correct on an affected machines. SO check the time on the exchange as well as on the routers and gateways... (so also WatchGuard).
Just to exclude this.

What we see here are CHUNK and BDAT command. They are part of ESMTP. mostly a problem of Exchange 2007.
So, the question is, if this is an issue with the Sender, the WatchGuard or Trend Micro. Usually Exchange 2010 should not have problems with such mails, but some issues in combination with above programs are known.

What I would try now (after each step, try again):
1.) make sure, Exchange is up to date.

2.) Inspect your devices (Watchguard , TM)
Read this article, they reference also to WatchGuard
 https://support.microsoft.com/en-us/kb/320027
Make sure the WatchGuard and also TM is up to date...

Not sure if you can change these settings on the WatchGuard. It would be the better solution.

3.) You may try to make some changes on Exchange to see, if this changes something...
Disable tarpitting....
get-ReceiveConnector | select name, tarpitInterval
to see and remember the current settings....
set-ReceiveConnector -Identity "ConnectorName" –TarpitInterval 00:00:00
to disable tarpitting

Disable BDAT and CHUNK
get-ReceiveConnector | select name, BinaryMimeEnabled, Chunking
to see the current settings

set-ReceiveConnector -Identity "ConnectorName" -BinaryMimeEnabled $False
set-ReceiveConnector -Identity "ConnectorName"  -Chunking $False
To disable BDAT and CHUNK (in this order).

Note that you should at least restart the Transport service to get it effective (or reboot).
If it doesn't help, reverse back to the default values.
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Christina TaylorIT AdministratorAuthor Commented:
Bembi,
Thank you, kindly.  I will review all of your recommendations and get back to you with my findings.
0
Christina TaylorIT AdministratorAuthor Commented:
In the few days that this question was open, I saw more domains attempting to send email with attachments having this same issue and not just Google Apps.

After reviewing all of our setting for WatchGuard and TM as suggested I moved on to Exchange and disable tarpitting... and low and behold that did the trick!

While this seems to have resolved the issue, why after all this time would this have created this kind of issue?
0
BembiCEOCommented:
You should have two point in your mind:
- update may be involved. Not every working scenario is a planned feature...
- changes of the mail provider.

They all fight against spam, a more liberal handling of the past may be replaced by a more restrictive handling of RFC definitions.

Or with MS word: Not a feature, just a bug ;-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Servers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.