Link to home
Start Free TrialLog in
Avatar of Steven
Steven

asked on

Service provider in external domain sending on behalf of an internal email address - hours of delay to some internal email recipients

Hi Team,

Brief explanation - one of our teams uses a service provider, "MARKUSA", to communicate to a massive amount (~1000+) of contacts; both internal @contoso.com and external @yahoo, @gmail, etc. They do this by using an internal email address "info@contoso.com". I wasn't aware for a while and never made any changes to allow them to do so. We're seeing that for a while now my internal @contoso accounts have a delay of an hour to perhaps a day or two before they receive the communication sent from MARKUSA email servers as the info@contoso.com address.

MARKUSA says the issue is on our end, that they are receiving a delay error for numerous recipients -

to=<insideguy@contoso.com>, relay=mail.contoso.com[{external.mail.IP}]:25, delay=8111, delays=8110/0.06/0.55/0, dsn=4.7.0, status=deferred (host mail.contoso.com)[external.mail.IP] refused to talk to me: 421 4.7.0 Too many concurrent connections.

They recommended adding an "include" option to my SPF record which I did but we are experiencing the same issues. All recipients outside our organization receive the communication in a timely manner, everyone inside, intermittently, experiences a delay or may not receive the communication at all.

What logs should I be looking at on my Exchange 2010 server to find these delays? My spam filter has a whitelist entry for MARKUSA, the mail server has an entry. The spam filter shows the sessions too and the emails coming in according to the times, delayed or not, that the user receives them in their inbox. I'm not sure where to look.
Avatar of David Favor
David Favor
Flag of United States of America image

This message is simple to understand...

to=<insideguy@contoso.com>, relay=mail.contoso.com[{external.mail.IP}]:25, delay=8111, delays=8110/0.06/0.55/0, dsn=4.7.0, status=deferred (host mail.contoso.com)[external.mail.IP] refused to talk to me: 421 4.7.0 Too many concurrent connections.

Open in new window


Means that mail.contoso.com is treating MARKUSA email servers as all other servers. As such, your mail.contoso.com considers MARKUSA servers to be sending you spam + your servers have throttled their mail to you.

This is incorrect, if you expect MARKUSA servers to send to your own users.

To fix this, you'll white list MARKUSA servers, so messages from them are never throttled.
Avatar of Steven
Steven

ASKER

Hi David,

To fix this, you'll white list MARKUSA servers, so messages from them are never throttled.

MARKUSA mail servers have already been white listed on our hardware spam filter and in the Anti-Spam settings in Exchange with no success.
I just added a Transport rule to set the spam level to 0 for the internal contoso.com address that MARKUSA uses for their communications. I will wait to see the results tomorrow when that team sends a communication.

Beyond that I'm not sure where else to add exceptions or white listing rules.
Avatar of Steven

ASKER

Adding a new transport rule for MARKUSA also didn't help.
This is super easy with Linux MTAs.

Exchange... Unsure...

Hopefully someone will chime in with an Exchange fix.

And, be sure to dig through your logs, which will likely give you clues about how to fix this.
This question needs an answer!
Become an EE member today
7 DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.