OK...thanks for your help. From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 4:25 PM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log
Darned if I know. All Exchange tells us is that it timed out waiting. Given only that clue - I recommend the SNP change. It's affected lots of people in strange ways. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Brown, Larry [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 3:13 PM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log But what is keeping the data block from downloading? Since I'm able to get the same newsletter at my RR account and since the vender isn't having problems with their other customers (that's they've admitted to anyway) I'm left believing it's a setting on our Edge servers. Yes, we are using Server 2003 SP2 (64 bit)...but we have not disabled SNP. Reading over the links, I see a couple of problems that might be related...will have to look in to this further. But I don't see anything that could be related to this problem...or am I missing something? From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 1:27 PM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log This means that while waiting to receive the next block of data from the sending server your local server timed out. That is, it gave up because it had waited too long. So, just because Olly brought this up recently, are you running Server 2003 sp2 on our Exchange Servers and if so, have you disabled the SNP? Wrappage: <http://theessentialexchange.com/blogs/michael/archive/2008/01/03/more-issues-with-the-windows-server-2003-scalable-networking-pack.aspx> Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Brown, Larry [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 12:14 PM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log Ah...that makes sense. I was so wrapped up in looking at IP's I didn't notice the email ID. Further down in the log I found a whole bunch of the bolded lines (every 5 seconds)...and then finally a Connection Timed Out error. I received the newsletter at my personal road runner account (and was able to forward it to the end user). So I have to assume the Edge servers are blocking something from downloading from 129.33.90.145??? Or am I on the wrong track? I did a brief search on 421 4.4.1 Connection timed out and didn't find much... The newsletter is a combination of pictures and an attached PDF, fyi... 2008-01-25T22:39:05.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,54,10.101.1.205:25,129.33.90.145:49745,>,"250 2.6.0 CHUNK received OK, 8268 octets", 2008-01-25T22:39:05.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,55,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268, 2008-01-25T22:39:10.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,56,10.101.1.205:25,129.33.90.145:49745,>,"250 2.6.0 CHUNK received OK, 8268 octets", 2008-01-25T22:39:10.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,57,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268, 2008-01-25T22:42:40.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,141,10.101.1.205:25,129.33.90.145:49745,<,BDAT 8268,2008-01-25T22:42:45.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,143,10.101.1.205:25,129.33.90.145:49745,>,421 4.4.1 Connection timed out, 2008-01-25T22:42:45.609Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,144,10.101.1.205:25,129.33.90.145:49745,-,,Local From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 11:00 AM To: MS-Exchange Admin Issues Subject: RE: SMTPReceive Log They are different. Notice the difference between "08CA20E15AD3A8FD" and "08CA20E15AD3A8FF". You need to find the denial conversation in the log to examine for us to make any guesses about the other...Perhaps it has something to do with IMF or Junk Mail on the recipients computer? Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Brown, Larry [mailto:[EMAIL PROTECTED] Sent: Monday, January 28, 2008 10:14 AM To: MS-Exchange Admin Issues Subject: SMTPReceive Log Hey all, I'm having an issue with a newsletter not being delivered. Other newsletters from the same company get through OK to the same user! The sending server for all of the newsletters is the same. Just to make sure I put the IP address in the IP Allow List on our Edge servers (129.33.90.145). We are using Exchange 2007 with Edge servers on a DMZ, Hub Transports and a CCR for the DB's. I found this entry in the SMTPReceive Log. My question is...if you look at the bolded part of the log it is showing a completely different IP address. Is this part of the same entry for 129.33.90.145, maybe referring to the IP address of the block list? Or is it referring to a different email and somehow got in the middle of the log entry? If the email IS blocked, then why do we receive other newsletters from the same IP address with no problems? 2008-01-25T22:37:40.328Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,1,10.101.1.205:25,129.33.90.145:49745,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions 2008-01-25T22:37:40.328Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,2,10.101.1.205:25,129.33.90.145:49745,>,"220 mail1.dplinc.com Microsoft ESMTP MAIL Service ready at Fri, 25 Jan 2008 17:37:40 -0500", 2008-01-25T22:37:40.359Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FD,20,10.101.1.205:25,65.184.246.107:4898,>,"550 5.7.1 Recipient not authorized, your IP has been found on a block list", 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,3,10.101.1.205:25,129.33.90.145:49745,<,EHLO moodysws114.usf-moodys.com, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,4,10.101.1.205:25,129.33.90.145:49745,>,250-mail1.dplinc.com Hello [129.33.90.145], 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,5,10.101.1.205:25,129.33.90.145:49745,>,250-SIZE 10485760, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,6,10.101.1.205:25,129.33.90.145:49745,>,250-PIPELINING, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,7,10.101.1.205:25,129.33.90.145:49745,>,250-DSN, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,8,10.101.1.205:25,129.33.90.145:49745,>,250-ENHANCEDSTATUSCODES, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,9,10.101.1.205:25,129.33.90.145:49745,>,250-X-ANONYMOUSTLS, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,10,10.101.1.205:25,129.33.90.145:49745,>,250-AUTH, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,11,10.101.1.205:25,129.33.90.145:49745,>,250-X-EXPS NTLM, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,12,10.101.1.205:25,129.33.90.145:49745,>,250-8BITMIME, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,13,10.101.1.205:25,129.33.90.145:49745,>,250-BINARYMIME, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,14,10.101.1.205:25,129.33.90.145:49745,>,250-CHUNKING, 2008-01-25T22:37:40.375Z,dmzexcet01\Default internal receive connector DMZEXCET01,08CA20E15AD3A8FF,15,10.101.1.205:25,129.33.90.145:49745,>,250 XEXCH50, Larry C. Brown LAN/WAN CS Support Dayton Power & Light (937)-331-4922 ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
