Re: Reading Exchange 2003 SMTP Logs / Expected emails don't always arrive

Paul,

I had asked my ISP to let me know what there SMTP logs were showing but
never got an answer, just they it was timing out.

However, I believe with Microsoft's help, we've found the cause of the issue
and it has nothing to do with Exchange itself (have spent a week on Exchange
trying to resolve an issue that simply doesn't exist).

The issue appears to be as a result of an advanced option on our servers NIC
connected to our ISP's router being enabled. The NIC's on our servers have
an option called 'Checksum Offload'. This option, by default, was enabled
for both Tx/Rx and TCP/IP. As soon as I disabled the option, the emails from
our ISP's relay servers came flooding in.

For your info, I have been monitoring the data packets and indeed there have
been many checksum errors with the option above enabled. So far with the
option disabled all seems to be well. I've read a few comments about the
"checksum offload" option and the impression I get is that it tends to cause
more problems than it's worth although I need to sit down and study this
better. I'm sure there's a valid reason and scenario in which enabling this
option would be beneficial.

All the same, I will continue to monitor things for a while longer. If there
are any other factors worth mentining I will post back but thank again for
replying. It's appeciated.

Sergio

"Paul Ford (Edge IT Ltd)" <paulford@xxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:O4ykhHjYHHA.4396@xxxxxxxxxxxxxxxxxxxxxxx
MSergio,

Is your ISP able to perform any kind of diagnostics logging so that we can
see why the messages are failing ?
Has this ever worked ?
Is your server on the Internet i.e. could the parent company connect
directly to it bypassing the ISPs relay servers ?
Have you got any Anti-Virus software loaded onto the Exchange server ?
In Exchange System Manager under Global Settings have a look at the
properties of Message Delivery, are there any settings under here that
could affect the message ?

Regards

Paul

"Sergio" <myname@xxxxxxxxxxxx> wrote in message
news:eSiMxwXYHHA.4008@xxxxxxxxxxxxxxxxxxxxxxx
Paul,

Thanks for your reply.

1) As far as I'm aware, no, the sender does not receive an NDR but I am
aware that there are soem emails that are being sent to our ISP's replay
servers which appear to be unable to forward them to us although I can
see communication between the servers. The ISP's replay servers never
send the DATA or BDAT command and the just quit after a short while.

2) I would say that the vast majority of emails get to us. To the best of
my knowledge were are experiencing the issue from only 2 external domains
(one is our ISP or more precisely their relay servers, and the other is a
parent company).

3) No. The message doesn't appear in the tracking logs. It's as if it's
never actually sent. Those that do appear in the tracking logs do arrive
in the users mailbox.

4) It does appear that the issue is occuring only with emails which have
attachments, but I have checked the 'Message Delivery Option' defaults
and both incoming and outgoing size restrictions are set at 15360KB. I'm
not aware of issues with emails which have no attachments (I have sent
myself countless test emails from private webmail accounts) and they all
seem to get through.

For your info, I have now opened a case with Microsoft. I'll post back
when I have some useful feedback/info but in the meantime if you have any
suggestions etc, they would be gratefully received.

Thanks again for taking the time to read, reply and help.
Sergio

"Paul Ford (Edge IT Ltd)" <paulford@xxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:%231bTuRRYHHA.4440@xxxxxxxxxxxxxxxxxxxxxxx
Sergio,

A few questions to see if we can work out the cause of the issue.

Does the sender of the message ever recieve an NDR ?
Do any other senders from other companies report any issues sending
email with attachments ?
Does the message appear in the message tracking logs your Exchange
server ?
Does it matter what size the attachments are i.e. do smaller
attachements get through ?
Do emails with no attachments get through from the sender experiencing
issues ?

Regards

Paul Ford


"Sergio" <myname@xxxxxxxxxxxx> wrote in message
news:e5zVthMXHHA.4880@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

We have been experiencing an issue now for a week or so and feel as
though I have exhausted every avenue in trying to find out why we are
having this issue. Essentially some emails (with attachment) aren't
always received by our users. The senders of the emails are, to the
best of my knowledge, always the same users. From what I can make out
the senders IT infrastructure has multiple Exchange servers
(maila.domain.net, mailb.domain.net, mailc.domain.net etc).

I have checked that no emails are getting blocked by the RBL we use and
have included the senders domain in a white list. I have checked that
the emails are not getting caught by our antivirus software. The email
that doesn't appear to arrive typically contains an attachment (approx
1 MB in size) and is sent to many people (maybe 30 or 40). I can
confirm that there isn't a restriction that would block the email due
to the number of intended recipients (I have left the default setting
of 5000 in Exchange) and likewise for inbound and outbound mail size
(currently set to 15 MB). There are no individula limits set.

I have setup SMTP logging and would like some assistance in reading the
following extract (I have changed both the senders IP address and
domain name for obvious reasons).

My understanding is that, taking the extract below:
1) server 'maild.domainn.net' with IP address 1.2.3.4 has established
comunicaton with our server 'SERVER1' with IP address 192.168.30.3
sucessfully (EHLO 250).
2) It then goes on to declare the senders email address (MAIL 250)
successfully.
3) It declares the email address of the recipients successfully (RCPT
250), and in this case there are 4 recipients.
4) There does *not* appear to be the DATA or BDAT declaration which
would tell our server to expect data (the email) to follow, it just
quits successfully (QUIT 240).

Is this normal? Why is there no DATA or BDAT?

2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 EHLO 250 311 27 0 SMTP -
2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 MAIL 250 54 41 15 SMTP -
2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 42 39 0 SMTP -
2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 44 41 0 SMTP -
2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 43 40 0 SMTP -
2007-03-02 11:11:17 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 42 39 0 SMTP -
2007-03-02 11:12:59 1.2.3.4 maild.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 QUIT 240 42 39 101406 SMTP -

In both the extracts below for SMTP communications from
'maill.domian.net' and 'mailm.domain.net' the process follows the steps
above but does contain the BDAT command.

2007-03-02 11:30:16 10.11.12.13 maill.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 EHLO 250 312 27 0 SMTP -
2007-03-02 11:30:16 10.11.12.13 maill.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 MAIL 250 56 43 0 SMTP -
2007-03-02 11:30:16 10.11.12.13 maill.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 44 41 0 SMTP -
2007-03-02 11:30:16 10.11.12.13 maill.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 BDAT 250 118 20136 203 SMTP -
2007-03-02 11:30:16 10.11.12.13 maill.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 QUIT 240 67 4 0 SMTP -

2007-03-02 11:34:21 100.101.102.103 mailm.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 EHLO 250 312 27 0 SMTP -
2007-03-02 11:34:21 100.101.102.103 mailm.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 MAIL 250 56 43 0 SMTP -
2007-03-02 11:34:21 100.101.102.103 mailm.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 RCPT 250 44 41 0 SMTP -
2007-03-02 11:34:21 100.101.102.103 mailm.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 BDAT 250 118 35705 313 SMTP -
2007-03-02 11:34:21 100.101.102.103 mailm.domain.net SMTPSVC1 SERVER1
192.168.30.3 0 QUIT 240 67 4 0 SMTP -

I have run pretty much every test I can think of on our servers and can
find nothing wrong but would grately appreciate any advice and/or
assistance even though I am beginning to think the problem may not be
at our end or may have something to do with the SDSL line we use for
Internet connectivity. I have also run Microsofts MS Exchange
Troubleshooting Assistant and that too came back clean.

I should mention that we use MS Exchange 2003 with SP1 which runs on MS
Windows 2003 with SP1 also.

Thanks in advance for any thoughts, comments and assiastance.
Sergio









.

Relevant Pages

  • Re: Reading Exchange 2003 SMTP Logs / Expected emails dont always arrive
    ... directly to it bypassing the ISPs relay servers? ... I would say that the vast majority of emails get to us. ... aware of issues with emails which have no attachments (I have sent myself ... Do any other senders from other companies report any issues sending email ...
    (microsoft.public.exchange.connectivity)
  • Re: MS Exchange 5.5 SP4: Outgoing internet mails disappears
    ... Outbound Internet Mail May Disappear After You Apply Exchange ... > the ISP mail servers. ... 3-4 out of 10 emails we ... > Initially we thought that it was due to ISP servers issue. ...
    (microsoft.public.exchange.connectivity)
  • Re: NTBackup finished the backup with errors.
    ... Now that I am reading the documentation that came with Symantec, ... > I don't use the Exchange attachment blocking, I prefer to let Trend Scanmail ... > attachments - because as you've noticed, ... >> select a location to put attachments that were removed from emails. ...
    (microsoft.public.windows.server.sbs)
  • Re: How to remove *all* attachments?
    ... >replaced by an Exchange 2003 server in a couple of ... >incoming emails (either to everyone or to a given ... >Is this possible just using Exchange? ... >attachments, none of which we need or are interested in. ...
    (microsoft.public.exchange.admin)
  • Reading Exchange 2003 SMTP Logs / Expected emails dont always arrive
    ... Essentially some emails aren't always received by ... From what I can make out the senders IT ... infrastructure has multiple Exchange servers (maila.domain.net, ... I have run pretty much every test I can think of on our servers and can find ...
    (microsoft.public.exchange.connectivity)