Some emails takes to much time to be delivered (or received) Exchange 2016/2013

Every now and then incoming emails are delayed (no warning) Either from a local (On Premise) Exchange user's mailbox to another Exchange On Premise user mailbox or from any external emails sent to an internal Exchange On Premise user mailbox.    We're in hybrid.  But those mailboxes are stored on the On Premise Exchange server.  Someone reported the same issue with a mailbox stored on Exchange online but I can,t confirm.  

I'm not sure but I think the older Exchange serveur (Exchange 2013)  is delaying the delivery.  Here S1-MBX-006 is an Exchange 2013 server used only to store the PFs mailboxes and databases (no other mailbox) S1-MBX-007 is the Exchange 2016  we've been using for years to handle the outgoing and incoming emails.  

We checked in OWA it's the same so it's not Outlook.  

Received: from S1-MBX-006.domain.com(192.168.3.206) by S1-MBX-007.domain.com
 (192.168.3.207) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.845.34 via Mailbox
 Transport; Wed, 21 Feb 2018 09:57:42 -0500
Received: from S1-MBX-007.domain.com (192.168.3.207) by S1-MBX-006.domain.com
 (192.168.3.206) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 21 Feb
 2018 09:21:29
-0500
Received: from S1-MBX-007.domain.com ([fe80::ace5:7772:cc:10bd]) by
 S1-MBX-007.domain.com ([fe80::ace5:7772:cc:10bd%13]) with mapi id
 15.01.0845.036; Wed, 21 Feb 2018 09:21:29 -0500
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: User 1 <username1@domain.com>
To: User 2 <username2@domain.com>
Subject: Planning
Thread-Topic: Planning
Thread-Index: AdOrHzvTJQuLXSLIRjqOcthEG4MPAw==
Date: Wed, 21 Feb 2018 09:21:29 -0500
Message-ID: <07fa09bd44fe4aa5b3eb44302a71feec@domain.com>
Accept-Language: en-CA en-CA
Content-Language: en-EN
X-MS-Has-Attach: yes  *** attachment is 8MB only)  ***
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <07fa09bd44fe4aa5b3eb44302a71feec@domain.com>
MIME-Version: 1.0
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthSource: S1-MBX-007.domain.com
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 03
X-Originating-IP: [192.168.5.218]
X-MS-Exchange-Organization-Network-Message-Id: 096c7dd3-5d81-4ee9-cf7e-08d57936662e
Return-Path: username1@domain.com
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Transport-EndToEndLatency: 00:36:12.9625314

Thanks
kt3zAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew LeniartSenior EditorCommented:
Hi kt3z,

Interesting that you highlighted the 8mb attachment in your posted log as that's what immediately popped into my mind when I was first reading your question. Do all of the delayed emails have attachments? If so, is it possible you have an AV mechanism scanning attachments which could be causing your exchange server to delay releasing delivery of the email until the scanning process has been completed?

Just a thought.
0
timgreen7077Exchange EngineerCommented:
The headers you added shows that their was a 36 minute delay happening from mail going from S1-MBX-006.domain.com(192.168.3.206) going to S1-MBX-007.domain.com (192.168.3.207).

Header
I would check to see if this only happens when you have attachments, I would also check the resources (HDD, CPU, RAM) on exchange when the mail is delayed like that, I would also check the transport queues to see if they are getting backed up or overloaded. based on your finding you can choose what actions to take.

If you can find a specific email that this has happened to, you can also look at the message tracking logs for that email and look at the hops and the status of the email as it was being delivered.

Also check for AV scanning at the time of the delays also.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
kt3zAuthor Commented:
Hi Andrew

Unfortunately it's not the case.  Some emails have no attachment.  Besides we don't have any scanner.  The anti-spam is cloud based but those emails are not going outside

Thanks
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

kt3zAuthor Commented:
Hi Tim

I'll check the queue.  I can't disable the local (proxy and )  ) received connectors on mbx6 but I'd like to drive mbx7 to handle all incoming and outgoing emails.

Thanks
0
timgreen7077Exchange EngineerCommented:
Check transport queue when that is happening and the server resources.
0
kt3zAuthor Commented:
Hi Tim,

What tool did you use to display the receive headers?  Queue tool is not working on MBX6.  TLS versions are different.  Is there any way to selectively disable different TLS versions?  

The server will be rebooted tonight.   In the meantime I would like to disable the transport service or anything that will keep MBX6 from handling incoming emails.  The only use of this server is the public folders.  2 users are moving their emails to the public folders.  Sometimes some users will search for an email stored in the public folders.  It will be migrated to Exchange online soon (then replaced by GROUPS as soon as we can move an email to GROUPS in Outlook - currently only possible in OWA)

So I can't disable the transport service, it will cause many more problems.  I'm just trying to figure out something to keep mbx6 from handling  incoming emails.  

Thanks again
0
timgreen7077Exchange EngineerCommented:
For the headers i went to exrca.com once there select the "Message Analyzer" tab, just copy and paste the email headers in the text box, and press the "Analyze Headers" button.

In regards to TLS here is a doc for that if you choose to disable select TLS settings:
https://blogs.technet.microsoft.com/exchange/2015/07/27/exchange-tls-ssl-best-practices/


Im not aware of a way to stop the server from being apart of the internal mail relay since its part of your environment. Stopping the transport service doesn't seem to be an option, you could put the server in maintenance mode. See the below:
https://blogs.technet.microsoft.com/nawar/2014/03/30/exchange-2013-maintenance-mode/

If maint mode enabled it will notify other exchange servers not to forward mail to it.
0
kt3zAuthor Commented:
Thanks !
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.