Hello everyone,
we are suffering by very interesting issue. I received report from one of our users that he have problems with receiving emails from MS branch office in Germany. I checked our mail server (I'm very new at the company) and discovered some configuration issues. I updated it to SP2 and changed configuration but without any impact on MS issue. I started searching exchange logs, firewall logs, I checked network communication via Wireshark and found this. Small emails are delivered to our users OK, midsize email (1-10MB) are delivered after approximately 40 minutes via our backup receive mail server (provided by our ISP) and large email are not received with NDR #< #4.4.7 smtp;550 4.4.7 QUEUE.Expired; message expired> #SMTP#. It is nearly same with hotmail. In wireshark and SMTP receive logs I can see that there is communication between our and MS mail servers but message is not received completely and after few attempts is routed via backup receive SMTP erver. Here is SMTP log from one attempt:
Line 48170: 2012-12-05T13:22:50.352Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,0,Mail-srvlocalIP:25,213.199.154.140:51049,+,,
Line 48171: 2012-12-05T13:22:50.352Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,1,Mail-srvlocalIP:25,213.199.154.140:51049,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session
Permissions
Line 48172: 2012-12-05T13:22:50.352Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,2,Mail-srvlocalIP:25,213.199.154.140:51049,>,"220 MYEMAILSERVER Microsoft ESMTP MAIL Service ready at Wed, 5 Dec 2012 14:22:49 +0100",
Line 48176: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,3,Mail-srvlocalIP:25,213.199.154.140:51049,<,EHLO db3outboundpool.messaging.microsoft.com,
Line 48177: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,4,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-MYEMAILSERVER Hello [213.199.154.140],
Line 48177: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,4,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-MYEMAILSERVER Hello [213.199.154.140],
Line 48178: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,5,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-SIZE,
Line 48179: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,6,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-PIPELINING,
Line 48180: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,7,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-DSN,
Line 48181: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,8,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-ENHANCEDSTATUSCODES,
Line 48182: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,9,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-STARTTLS,
Line 48183: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,10,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-AUTH NTLM,
Line 48184: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,11,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-8BITMIME,
Line 48185: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,12,Mail-srvlocalIP:25,213.199.154.140:51049,>,250-BINARYMIME,
Line 48186: 2012-12-05T13:22:50.399Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,13,Mail-srvlocalIP:25,213.199.154.140:51049,>,250 CHUNKING,
Line 48187: 2012-12-05T13:22:50.446Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,14,Mail-srvlocalIP:25,213.199.154.140:51049,<,MAIL FROM: <userMS@microsoft.com> SIZE=715770 AUTH=<>,
Line 48188: 2012-12-05T13:22:50.446Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,15,Mail-srvlocalIP:25,213.199.154.140:51049,*,08CFA0637E2C53A0;2012-12-05T13:22:50.352Z;1,receiving message
Line 48189: 2012-12-05T13:22:50.446Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,16,Mail-srvlocalIP:25,213.199.154.140:51049,>,250 2.1.0 Sender OK,
Line 48190: 2012-12-05T13:22:50.477Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,17,Mail-srvlocalIP:25,213.199.154.140:51049,<,RCPT TO: <myuser@mycompany.com>,
Line 48193: 2012-12-05T13:22:50.790Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,18,Mail-srvlocalIP:25,213.199.154.140:51049,>,250 2.1.5 Recipient OK,
Line 48194: 2012-12-05T13:22:50.883Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,19,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2898,
Line 48195: 2012-12-05T13:22:50.883Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,20,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48197: 2012-12-05T13:22:51.899Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,21,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2898 octets",
Line 48198: 2012-12-05T13:22:51.899Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,22,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3096,
Line 48199: 2012-12-05T13:22:51.899Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,23,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48203: 2012-12-05T13:22:52.914Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,24,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3096 octets",
Line 48204: 2012-12-05T13:22:52.914Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,25,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2340,
Line 48205: 2012-12-05T13:22:52.914Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,26,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48206: 2012-12-05T13:22:53.930Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,27,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2340 octets",
Line 48207: 2012-12-05T13:22:53.930Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,28,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3646,
Line 48208: 2012-12-05T13:22:53.930Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,29,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48230: 2012-12-05T13:22:54.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,30,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3646 octets",
Line 48231: 2012-12-05T13:22:54.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,31,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48232: 2012-12-05T13:22:54.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,32,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48235: 2012-12-05T13:22:55.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,33,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48236: 2012-12-05T13:22:55.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,34,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48237: 2012-12-05T13:22:55.945Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,35,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48238: 2012-12-05T13:22:56.960Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,36,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48239: 2012-12-05T13:22:56.960Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,37,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48240: 2012-12-05T13:22:56.960Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,38,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48241: 2012-12-05T13:22:57.975Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,39,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48242: 2012-12-05T13:22:57.975Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,40,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48243: 2012-12-05T13:22:57.975Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,41,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48244: 2012-12-05T13:22:58.991Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,42,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48245: 2012-12-05T13:22:58.991Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,43,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48246: 2012-12-05T13:22:58.991Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,44,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48247: 2012-12-05T13:23:00.006Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,45,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48248: 2012-12-05T13:23:00.006Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,46,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48249: 2012-12-05T13:23:00.006Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,47,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48250: 2012-12-05T13:23:01.021Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,48,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48251: 2012-12-05T13:23:01.021Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,49,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48252: 2012-12-05T13:23:01.021Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,50,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48253: 2012-12-05T13:23:02.037Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,51,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48254: 2012-12-05T13:23:02.037Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,52,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48255: 2012-12-05T13:23:02.037Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,53,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48256: 2012-12-05T13:23:03.052Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,54,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48257: 2012-12-05T13:23:03.052Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,55,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48258: 2012-12-05T13:23:03.052Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,56,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48259: 2012-12-05T13:23:04.068Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,57,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48260: 2012-12-05T13:23:04.068Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,58,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48261: 2012-12-05T13:23:04.068Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,59,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48262: 2012-12-05T13:23:05.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,60,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48263: 2012-12-05T13:23:05.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,61,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48264: 2012-12-05T13:23:05.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,62,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48265: 2012-12-05T13:23:06.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,63,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48266: 2012-12-05T13:23:06.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,64,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48267: 2012-12-05T13:23:06.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,65,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48268: 2012-12-05T13:23:07.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,66,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48269: 2012-12-05T13:23:07.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,67,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48270: 2012-12-05T13:23:07.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,68,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48271: 2012-12-05T13:23:08.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,69,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48272: 2012-12-05T13:23:08.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,70,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48273: 2012-12-05T13:23:08.067Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,71,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48274: 2012-12-05T13:23:09.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,72,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48275: 2012-12-05T13:23:09.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,73,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48276: 2012-12-05T13:23:09.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,74,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48277: 2012-12-05T13:23:10.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,75,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48278: 2012-12-05T13:23:10.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,76,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48279: 2012-12-05T13:23:10.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,77,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48280: 2012-12-05T13:23:11.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,78,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48281: 2012-12-05T13:23:11.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,79,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48282: 2012-12-05T13:23:11.066Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,80,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48283: 2012-12-05T13:23:12.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,81,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48284: 2012-12-05T13:23:12.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,82,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48285: 2012-12-05T13:23:12.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,83,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48286: 2012-12-05T13:23:13.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,84,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 2964 octets",
Line 48287: 2012-12-05T13:23:13.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,85,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 3042,
Line 48288: 2012-12-05T13:23:13.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,86,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48289: 2012-12-05T13:23:14.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,87,Mail-srvlocalIP:25,213.199.154.140:51049,>,"250 2.6.0 CHUNK received OK, 3042 octets",
Line 48290: 2012-12-05T13:23:14.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,88,Mail-srvlocalIP:25,213.199.154.140:51049,<,BDAT 2964,
Line 48291: 2012-12-05T13:23:14.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,89,Mail-srvlocalIP:25,213.199.154.140:51049,*,Tarpit for '0.00:00:01',
Line 48292: 2012-12-05T13:23:15.065Z,MAIL-SRV\Default MAIL-SRV,08CFA0637E2C53A0,90,Mail-srvlocalIP:25,213.199.154.140:51049,-,,Remote
I already know that we have this problems just with MS. Emails from all other companies are received without errors.
Would you people advice me please what should I do?
Thanks a lot!