Ah...that makes sense. I was so wrapped up in looking at IP's I didn't notice the email ID.
Further down in the log I found a whole bunch of the bolded lines (every 5 seconds)...and then finally a Connection Timed Out error. I received the newsletter at my personal road runner account (and was able to forward it to the end user). So I have to assume the Edge servers are blocking something from downloading from 129.33.90.145??? Or am I on the wrong track? I did a brief search on 421 4.4.1 Connection timed out and didn't find much... The newsletter is a combination of pictures and an attached PDF, fyi... 2008-01-25T22:39:05.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,54,10.101.1.205:25,129.33.90.145:49745,>,"250 2.6.0 CHUNK received OK, 8268 octets", 2008-01-25T22:39:05.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,55,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268, 2008-01-25T22:39:10.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,56,10.101.1.205:25,129.33.90.145:49745,>,"250 2.6.0 CHUNK received OK, 8268 octets", 2008-01-25T22:39:10.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,57,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268, 2008-01-25T22:42:40.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,141,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268,2008-01-25T22:42:45.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,143,10.101.1.205:25,129.33.90.145:49745,>,421 4.4.1 Connection timed out, 2008-01-25T22:42:45.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,144,10.101.1.205:25,129.33.90.145:49745,-,,Local From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 11:00 AM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log They are different. Notice the difference between "08CA20E15AD3A8FD" and "08CA20E15AD3A8FF". You need to find the denial conversation in the log to examine for us to make any guesses about the other...Perhaps it has something to do with IMF or Junk Mail on the recipients computer? Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Brown, Larry [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 10:14 AM To: MS-Exchange Admin Issues Subject: SMTPReceive Log Hey all, I'm having an issue with a newsletter not being delivered. Other newsletters from the same company get through OK to the same user! The sending server for all of the newsletters is the same. Just to make sure I put the IP address in the IP Allow List on our Edge servers (129.33.90.145). We are using Exchange 2007 with Edge servers on a DMZ, Hub Transports and a CCR for the DB's. I found this entry in the SMTPReceive Log. My question is...if you look at the bolded part of the log it is showing a completely different IP address. Is this part of the same entry for 129.33.90.145, maybe referring to the IP address of the block list? Or is it referring to a different email and somehow got in the middle of the log entry? If the email IS blocked, then why do we receive other newsletters from the same IP address with no problems? 2008-01-25T22:37:40.328Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,1,10.101.1.205:25,129.33.90.145:49745,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions 2008-01-25T22:37:40.328Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,2,10.101.1.205:25,129.33.90.145:49745,>,"220 mail1.dplinc.com Microsoft ESMTP MAIL Service ready at Fri, 25 Jan 2008 17:37:40 -0500", 2008-01-25T22:37:40.359Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FD,20,10.101.1.205:25,65.184.246.107:4898,>,"550 5.7.1 Recipient not authorized, your IP has been found on a block list", 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,3,10.101.1.205:25,129.33.90.145:49745,<,EHLO moodysws114.usf-moodys.com, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,4,10.101.1.205:25,129.33.90.145:49745,>,250-mail1.dplinc.com Hello [129.33.90.145], 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,5,10.101.1.205:25,129.33.90.145:49745,>,250-SIZE 10485760, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,6,10.101.1.205:25,129.33.90.145:49745,>,250-PIPELINING, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,7,10.101.1.205:25,129.33.90.145:49745,>,250-DSN, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,8,10.101.1.205:25,129.33.90.145:49745,>,250-ENHANCEDSTATUSCODES, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,9,10.101.1.205:25,129.33.90.145:49745,>,250-X-ANONYMOUSTLS, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,10,10.101.1.205:25,129.33.90.145:49745,>,250-AUTH, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,11,10.101.1.205:25,129.33.90.145:49745,>,250-X-EXPS NTLM, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,12,10.101.1.205:25,129.33.90.145:49745,>,250-8BITMIME, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,13,10.101.1.205:25,129.33.90.145:49745,>,250-BINARYMIME, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,14,10.101.1.205:25,129.33.90.145:49745,>,250-CHUNKING, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,15,10.101.1.205:25,129.33.90.145:49745,>,250 XEXCH50, Larry C. Brown LAN/WAN CS Support Dayton Power & Light (937)-331-4922 ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~