Missing Email - ORF Forums

Missing Email RSS Back to forum

1

Hello. I just updated my serve to SBS 2011 and installed the latest ORF software.
Basically, it is working ok, except that some emails just seem to disappear.

An email whose sender is whitlisted - shows up in the ORF logs as "Whitelist" on the filtering point "Before Arrival" and then never appears again.
Should it not be listed twice, Before and On arrival?

On the SBS server the "Contenct Filtering' is Disabled, as is the AntiSpam part of my Virus software.

In Microsoft Exchange - Message Tracking Results - the is no listing of any email from that Address.

Where did the email go?

Matt R.

Reply
by Matt Reed more than 10 years ago
2

@Matt Reed: Do you have SMTP protocol logging enabled? If so, what does it indicate?

http://technet.microsoft.com/en-us/library/bb124531.aspx
http://technet.microsoft.com/en-us/library/aa997624.aspx

The Before Arrival filtering of ORF is performed after the RCPT TO: command during SMTP transport, while On Arrival filtering happens at the end of the DATA/BDAT command (en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_transport_example). If you see a Before Arrival log entry, but no On Arrival, that means the connection was terminated (by something, not ORF) after RCPT TO: but before the end of DATA/BDAT.

It could have been a corrupted/malformed email, or the sender gave up the delivery attempt for some reason and terminated the connection, or your resident anti-virus filter detected a virus during the transport and diverted/dropped the email, or something like that.

What Transport Agents do you have enabled, and in what order? (Exhange Management Shell, run "Get-TransportAgent | Format-List" without the quotes)

Reply
by Krisztian Fekete (Vamsoft) more than 10 years ago
(in reply to this post)

3

We've seen this issue also with ORF and SBS2011. Basically, to this day, a few domains attempt to e-mail us and they get delayed delivery of large e-mails. I've worked with admins and they all say it's our domain that is slowing down the reception of their mail. I have looked through various settings in Exchange and our network and firewall and can't see why one domain versus another would delay e-mails based on size, our attachment limits are very high and our pipe is fast.

SMTP protocol enabled doesn't show anything significant, no blocking or rejections of the domain.
ORF logs show many "recipient whitelisted by the Auto Sender Whitelist," but the e-mails never get to the recipients. I imagine these are status messages that ORF is whitelisting?

Here are our Transport Agents, note we also use Exclaimer, which adds signatures to outgoing e-mails and does some rules based processing for us...:


RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 1
TransportAgentFactory : Exclaimer.Connectors.MailRules.Transport.Factory
AssemblyPath : C:\Program Files\Exclaimer Ltd\Mail Disclaimers\Exclaimer.Connectors.MailRules.dll
Identity : Exclaimer Mail Disclaimers Routing Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 2
TransportAgentFactory : Exclaimer.Capabilities.MailRules.AutoResponders.ARFactory
AssemblyPath : C:\Program Files\Exclaimer Ltd\Auto Responder\Exclaimer.Capabilities.MailRules.AutoResponders.d
ll
Identity : Exclaimer Auto Responder Routing Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 3
TransportAgentFactory : Vamsoft.ORF.TransportAgents.VSSmtpReceiveAgentFactory
AssemblyPath : C:\Program Files (x86)\ORF Enterprise Edition\orftagent.dll
Identity : Vamsoft ORF SMTP Receive Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 4
TransportAgentFactory : Vamsoft.ORF.TransportAgents.VSRoutingAgentFactory
AssemblyPath : C:\Program Files (x86)\ORF Enterprise Edition\orftagent.dll
Identity : Vamsoft ORF Routing Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 5
TransportAgentFactory : Microsoft.Exchange.MessagingPolicies.TransportRuleAgent.TransportRuleAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Rule\Microsoft.Exchange.Me
ssagingPolicies.TransportRuleAgent.dll
Identity : Transport Rule Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 6
TransportAgentFactory : Microsoft.Exchange.TextMessaging.MobileDriver.TextMessagingRoutingAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.MobileDriver.dll
Identity : Text Messaging Routing Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 7
TransportAgentFactory : Microsoft.Exchange.TextMessaging.MobileDriver.TextMessagingDeliveryAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\bin\Microsoft.Exchange.MobileDriver.dll
Identity : Text Messaging Delivery Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 8
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.ConnectionFiltering.ConnectionFilteringAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Connection Filtering Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 9
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.ContentFilter.ContentFilterAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Content Filter Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 10
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.SenderId.SenderIdAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Sender Id Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 11
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.ProtocolFilter.SenderFilterAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Sender Filter Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 12
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.ProtocolFilter.RecipientFilterAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Recipient Filter Agent
IsValid : True

RunspaceId : 60f07ee7-b742-4fa6-97bc-a7a76540d990
Enabled : True
Priority : 13
TransportAgentFactory : Microsoft.Exchange.Transport.Agent.ProtocolAnalysis.ProtocolAnalysisAgentFactory
AssemblyPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\agents\Hygiene\Microsoft.Exchange
.Transport.Agent.Hygiene.dll
Identity : Protocol Analysis Agent
IsValid : True

Reply
by indy more than 10 years ago
4

@indy: is it not possible that the message throttling mechanisms of Exchange are causing the delayed delivery of these large emails?

http://technet.microsoft.com/en-us/library/bb232205.aspx

http://technet.microsoft.com/en-us/library/bb201658.aspx

Reply
by Krisztian Fekete (Vamsoft) more than 10 years ago
(in reply to this post)

5

Microsoft recommends not modifying the default throttling policy. I'm hesitant to do so. I haven't seen any event logs indicating back pressure issues. This is a very low-volume server and frankly vastly overpowered for its uses.

However, I have tweaked a few settings, to no avail:
Tried setting TarpitInterval to 00:00:00
and MaxAcknowledgementDelay to 00:00:15. With no difference to receiving external mail from these two domains.

Do you know of a central location to look to see what exactly Microsoft Exchange has done to an internal SMTP receive request, and what rules applied? I'm only a part-time Exchange admin, so I don't recognize where a logical location for such rules would be applied would be.

Reply
by indy more than 10 years ago
6

@indy: Unfortunately, I am not aware of any monitoring tool or log of Exchange that could be used to track exactly what rules have been triggered and how message throttling has been evaluated.

By the way, do you have Tarpit Delay enabled in ORF by any chance (Administration Tool: Tests / Tests)? If so, I recommend to disable that as well: blacklisted emails are held up and as the Exchange server keeps each connection alive, it may run out of threads.

Other than that, I cannot think of any action of ORF that may cause such issues: if it logged the email was whitelisted, that means it did not interfere its delivery at all. ORF is not involved in actual email delivery, that is entirely up to Exchange: ORF only tells Exchange to return an 5.x.x response upon blacklisting, but if the email is whitelisted it does not really do anything to it.

Reply
by Krisztian Fekete (Vamsoft) more than 10 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2