Problem with Exchange 5.5: Delay In Sending Mail....

[crazycelicagts1]

Hi everyone, I am having a problem with Exchange 5.5....whenever I send mail out, it takes a long time to get to that person. Sometimes it would take a day and sometime it would take 10 minutes. What can be the problem with this? I haven't touch the server lately and I don't think my other co-workers did anything to it. The exchange is on NT 4.0 with the latest patches. Anyone can help me out on this??

 

[Saltin]

Problems sending mail are almost always DNS related. Check to make sure your DNS is functioning properly. Do you run your own, or do you use your ISP's?

 

[crazycelicagts1]

we run our own DNS server...i looked at it and everything look right...what kind of things am I suppose to look at? what do you recommend checking? whenever I trace a computer's name, it translate it to an IP address so i'm sure the DNS is working properly...what else can I check?

 

[Saltin]

Delays in sending mail generally mean that DNS is failing on the initial lookup. Do you see this behaviour with all email or just email destined for certain domains?

You can test name resolution a little more reliably with nslookup at the command prompt.

 

[crazycelicagts1]

wus up man...yeah i try the nslookup...it would find the name and the address...like if i type in nslookup www.yahoo.com it would give me name, addresses, and aliases...i also did the nslookup for the server on our network and it works. What else do I need to check? any other test?

and this is with all domain and not just one. If i send myself something from yahoo...it would take 3 minutes to get to me. If i send something, i don't know when i'mgonna get it in yahoo, thanks for helping me out....much appreciated.

 

[crazycelicagts1]

ttt

 

[crazycelicagts1]

Hi everyone, i need some help with DNS in Exchange Server 5.5...cause when I send or anyone that sends a email, it seems it doesn't get there or if it does it would get there really late. So I did the nslookup in dos. This is what it showed up:

c:\desktop>nslookup

default server: frs-edge.domain.com address: 192.168.2.201

>set type=mx

>domain.com Server: frs-edge.domain.com address: 192.168.2.201

domain.com MX preference=10, mail exchanger= frs-exchange.domain.com

frs-exchange.domain.com internet address = 192.168.2.168

well when i nslookup some other site, i noticed that i'm missing the nameserver portion...my question is how do I add the nameserver.

this is what it looks like when i did a nslookup on yahoo.com: Server: ns1.yahoo.com Address: 66.218.71.63

www.yahoo.com

yahoo.com MX preference = 1, mail exchanger = mx2.mail.yahoo.com
yahoo.com MX preference = 5, mail exchanger = mx4.mail.yahoo.com
yahoo.com MX preference = 1, mail exchanger = mx1.mail.yahoo.com

yahoo.com nameserver = ns1.yahoo.com
yahoo.com nameserver = ns2.yahoo.com
yahoo.com nameserver = ns3.yahoo.com
yahoo.com nameserver = ns4.yahoo.com
yahoo.com nameserver = ns5.yahoo.com

ns1.yahoo.com internet address = 66.218.71.63
ns2.yahoo.com internet address = 209.132.1.28
ns3.yahoo.com internet address = 217.12.4.104
ns4.yahoo.com internet address = 63.250.206.138
ns5.yahoo.com internet address = 64.58.77.85

so does anyone know how to put in the nameserver and also i notice that the internet address for my company is set to an inside address of 192.168.2.168. Is that correct or should I have that point to the server that goes to the outside world...i don't know...HELP ME OUT GUYS!!!!!!!!!!!!!

 

[Ronnie1]

I don't know if this will help, but there's a new network monitoring tool available, called AppDancer/FA, that monitors Microsoft Exchange Server user transactions in real time. It won the Best of Interop at Networld+Interop in Network Management this past May. There is a 14 day free trial available on their website, www.appdancer.com, so it might be worth a try in order to solve your problem. Hope this will tell you what is happening with your transactions.

 

[Saltin]

Your nslookup is from your private DNS server. It's returning private IP addresses to you. That's fine, but you are going to need a static public IP to recieve mail at. What's more, you are going to need to register that IP to a domain name with a registry service.

 

[Garion]

IMHO, it's always easier to let your ISP do your mail delivery for you, if you don't send out too many messages. Ask them what their mail relay host is, and configure your IMC/IMS to deliver all new messages to it. That's the easiest way to do it, and takes a load off your server.

- G

 

[bozo1]

Originally posted by: Garion
IMHO, it's always easier to let your ISP do your mail delivery for you, if you don't send out too many messages. Ask them what their mail relay host is, and configure your IMC/IMS to deliver all new messages to it. That's the easiest way to do it, and takes a load off your server.

- G

I totally agree - if your ISP offers that service you should use it.

I think there are some basic troubleshooting steps that you are missing. Are you sure it's a DNS problem? Have you looked at your message queue (MTA) and do you see the messages stuck there? Have you turned up the logging level on the IMC and checked your event log to see what's going on? Is it trying to send the messages and failing and if so with what error?

 

[crazycelicagts1]

Hi guys...yeah when I did the nslookup at work, it return the private IP addresses. Here is what it looks like from the outside:

c:\nslookup trans-western.com

Server: dns1.frsn01.pacbell.net
Address: 63.202.63.72

Name: domain.com
Address: 63.192.187.130

c:/nslookup

>set type=mx
>domain.com
Server: dns1.frsn01.pacbell.net
Address: 63.202.63.72

domain.com MX preference=10, mail
exchanger=domain.com

domain.com MX perference=100, mail
exchanger=smtp-relay.pbi.net

domain.com nameserver=ns1.pbi.net
domain.com nameserver=ns2.pbi.net

domain.com internet address=63.192.187.130
smtp-relay.pbi.net internet address=206.13.28.30
smtp-relay.pbi.net internet address=206.13.28.8
ns1.pbi.net internet address = 206.13.28.11
ns2.pbi.net internet address = 206.13.29.11


well it does have a public address, its 63.192.187.130, thats one of the server that is on our network that is going out. The exchange goes to that server and then goes out. So is ns1.pbi.net the dns mail relay host???? and what do I need to do? configuring wise in exchange? thnx for all your help

 

[bozo1]

Your DNS entries have nothing to do with you sending mail, only receiving.

You need to find out why things are taking so long. As I said above, look in the site MTA in Exchange Administrator and look at the IMC queue. Is stuff stuck there? If so, then you have a problem which may be DNS related but I doubt it as you say mail eventually goes out. Your problem is probably elsewhere. If nothing is getting queued up, then it is going out and the delay is on the receiving end which you can do nothing about it. It is very common for Yahoo and other public mail servers like that to take a long time occasionally. Often I see mails queued for them for minutes and sometimes hours due to problems on their end.

To ensure that stuff is going out normally, use Exchange Administrator, open up your IMC and up the logging level to maximum. Send an email then view your Application Event Log - you should be able to see the communication dialog between you and the other end.

 

[crazycelicagts1]

Originally posted by: bozo1
Your DNS entries have nothing to do with you sending mail, only receiving.

You need to find out why things are taking so long. As I said above, look in the site MTA in Exchange Administrator and look at the IMC queue. Is stuff stuck there? If so, then you have a problem which may be DNS related but I doubt it as you say mail eventually goes out. Your problem is probably elsewhere. If nothing is getting queued up, then it is going out and the delay is on the receiving end which you can do nothing about it. It is very common for Yahoo and other public mail servers like that to take a long time occasionally. Often I see mails queued for them for minutes and sometimes hours due to problems on their end.

To ensure that stuff is going out normally, use Exchange Administrator, open up your IMC and up the logging level to maximum. Send an email then view your Application Event Log - you should be able to see the communication dialog between you and the other end.

okay so my dns is okay, right? what and how do I take a look at the MTA, I see MTA Site configuration in exchange, is that it? what do i need to do in it? everything in there is set to default. I looked in the IMC queue and there are nothing qued up. There are like 4 message for the inbound delivery but that shouldn't matter. thanks for the quick response.

 

[bozo1]

I'm trying to remember without having Exchange in front of me.

If you only have one Exchange Site, you probably don't have what I'm thinking about. The queues in the IMC is what you need to look at. Send an outbound email and if you don't see it stuck in the queue, it should have gone out. If you turn up the logging level on the IMC, you should be able to go into NT's Event Viewer and see that it was actually delivered to the destination. If you see all that, I don't think you have a problem.

At my company, we use a standalone email gateway to handle incoming/outgoing emails, virus scanning, file blocking, etc. With those, it is very easy to see things coming and going and diagnosing problems. At any given time, we usually have 10-20 different domains queued up because the other end is down or not functioning properly. Eventually they come up. It is very common to see hotmail, yahoo, msn, directv in the list.

And keep in mind that once it is delivered to the other end, there is nothing you can do about it. Where it is delivered to is usually just a receiving machine, the emails have to find their way within the destinations network to whatever machine the mailbox actually resides on. It can be delivered but still take time to get to the receiver if they are having troubles.

 

[crazycelicagts1]

i did that, i was looking at the que while I was sending a msg and I didn't see anything pop in the "outbound messages awaiting delivery" or the "outbound messages awaiting conversion"...also I set the diagnostic log for smtp protocol log and smtp interface events to maximum. To view the log, I go to icmdata...then log folder and open up that with notepad, right??

 

[bozo1]

Yep, open that up. There will also be alot of info put into NT's Event Viewer.

 

[bozo1]

If you didn't catch it, I edited my response above while you were posting your last one.

 

[crazycelicagts1]

i can't open it up in event viewer...i can open it in notepad. so what do I need to look at the MTA?? and what am I looking in the log? I see all the msg that are coming in but i don't see anything about mail being sented out...there are no entries. So what can this be???? what do I have to look at with the MTA??

 

[bozo1]

Forget the MTA, I was thinking about something else.

Your IMC log files will show if there is an error with delivery and the message was rescheduled for a later attempt. You just have to dig through the junk looking for errors.

What you also need to look at is your Event Viewer. Forget Exchange Administrator and all that. I'm talking about the regular NT Event Viewer. Look in the Application Events and you will see successful/failed delivery attempts logged.

Again, I really don't think you have a problem here. I think you are just seeing the receiving end being uncooperative occasionally.

 

[crazycelicagts1]

okay i checked the Event Log, here is what it has for the previous hour or so:

7/8/02 9:44:58 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mailer8.offertoday.net. Logfile: L0000000.LOG

7/8/02 9:41:13 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail.anandtech.com. Logfile: L0000000.LOG

7/8/02 9:28:18 AM MSExchangeSA Information General 5000 N/A FRS-EXCHANGE
Recalculation of the routing table is complete. Result: The operation has completed successfully.

7/8/02 9:12:08 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail13.quickinspirations.com. Logfile: L0000000.LOG

7/8/02 9:10:50 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 67.89.209.77. Logfile: L0000000.LOG

7/8/02 9:00:18 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host smtp-3.his.com. Logfile: L0000000.LOG

7/8/02 8:54:21 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail3.newfunpages.com. Logfile: L0000000.LOG

7/8/02 8:36:55 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host ns.scif.com. Logfile: L0000000.LOG

7/8/02 8:31:37 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail.anandtech.com. Logfile: L0000000.LOG

7/8/02 8:13:34 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail.anandtech.com. Logfile: L0000000.LOG

7/8/02 8:10:22 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host computer1.gowanco.com. Logfile: L0000000.LOG

7/8/02 8:09:42 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 65.164.228.41. Logfile: L0000000.LOG

7/8/02 8:05:28 AM MSExchangeIS Private Success Audit Logons 1016 N/A FRS-EXCHANGE
NT
User TWIA\EHAWKINS logged on to Marscinia Robinson mailbox, and is not the primary Windows NT account on this mailbox.

7/8/02 8:05:20 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail.anandtech.com. Logfile: L0000000.LOG

7/8/02 8:04:07 AM MSExchangeIS Private Success Audit Logons 1016 N/A FRS-EXCHANGE
NT User TWIA\MTORRES logged on to Dom Madrigal mailbox, and is not the primary Windows NT account on this mailbox.

7/8/02 8:02:29 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host www29.123greetings.com. Logfile: L0000000.LOG

7/8/02 8:00:33 AM MSExchangeIS Private Success Audit Logons 1016 N/A FRS-EXCHANGE
NT User TWIA\AQUINTANILLA logged on to Juli Lawson mailbox, and is not the primary Windows NT account on this mailbox.

7/8/02 8:00:33 AM MSExchangeIS Private Success Audit Logons 1016 N/A FRS-EXCHANGE
NT User TWIA\AQUINTANILLA logged on to Toni Hernandez mailbox, and is not the primary Windows NT account on this mailbox.

7/8/02 7:57:51 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host www.nogal.com.pe. Logfile: L0000000.LOG

7/8/02 7:56:28 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 198.204.79.252. Logfile: L0000000.LOG

7/8/02 7:56:28 AM MSExchangeSA Error General 2037 N/A FRS-EXCHANGE
The file version of '\add-ins\MS\i386\conadmin.dll' installed on the local server is not current. Unable to locate a correct version on any server in the site.

7/8/02 7:56:28 AM MSExchangeSA Information General 2036 N/A FRS-EXCHANGE T
he file version of 'C:\exchsrvr\add-ins\MS\i386\conadmin.dll' installed on the local server is not current. Looking at servers in the site for a current
version.

7/8/02 7:44:36 AM MSExchangeSA Error General 2037 N/A FRS-EXCHANGE
The file version of '\add-ins\MS\i386\conadmin.dll' installed on the local server is not current. Unable to locate a correct version on any server in the site.

7/8/02 7:44:36 AM MSExchangeSA Information General 2036 N/A FRS-EXCHANGE The file version of 'C:\exchsrvr\add-ins\MS\i386\conadmin.dll' installed on the local server is not current. Looking at servers in the site for a current version.

7/8/02 7:42:34 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host uuout9smtp3.uu.flonetwork.com. Logfile: L0000000.LOG

7/8/02 7:42:25 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host uuout13smtp15.uu.flonetwork.com. Logfile: L0000000.LOG

7/8/02 7:35:47 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE A new TCP/IP SMTP connection has been received from host mail.anandtech.com. Logfile: L0000000.LOG

7/8/02 7:22:17 AM MSExchangeIS Private Success Audit Logons 1016 N/A FRS-EXCHANGE NT User TWIA\MROBINSON logged on to Yvette Andrews mailbox, and is not the primary Windows NT account on this mailbox.

7/8/02 7:20:21 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 12.37.97.18. Logfile: L0000001.LOG

7/8/02 7:20:21 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 12.37.97.18. Logfile: L0000000.LOG

7/8/02 7:00:07 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host mail3.newfunpages.com. Logfile: L0000000.LOG

7/8/02 6:58:56 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new
TCP/IP SMTP connection has been received from host mail9.aweber.com. Logfile: L0000000.LOG

7/8/02 6:30:36 AM MSExchangeIMC None SMTP Interface Events 2000 N/A FRS-EXCHANGE
A new TCP/IP SMTP connection has been received from host 203.248.170.235. Logfile: L0000000.LOG

 

[bozo1]

Did you send anything out during that timeframe? Everything in there is incoming.

 

[crazycelicagts1]

ya i sented out like 3 emails in the pass hour or so and i'm sure the other people in the companies have sented out a couple also. So what do you think it can be??

 

[bozo1]

OK, try this and note step #6. You did this but I don't know if you restarted the IMC service which may be why you aren't seeing what you need in the logs and event viewer:

To start SMTP protocol logging, follow these steps:

1. Start the Exchange Server Administrator program.
2. Select the Internet Mail Service. On the File menu, select Properties.
3. Click the Diagnostic Logging tab.
4. Select SMTP Protocol Log and set it to Maximum.
5. Close the property page for the Internet Mail Service.
6. Stop and restart the Internet Mail Service.
With protocol logging turned on, the Internet Mail Service creates an L000000#.log file in the Exchsrvr\Imcdata\Log subdirectory on the Exchange Server computer. Keep in mind that these .log files take up a large amount of space on the hard disk, depending on the volume of messages going through the connector. Protocol logging should be used only to troubleshoot a specific problem and should be turned off during normal use of the connector.

Once this is done you should see something like the following in your current log file. This is what a successfully sent message conversation should look like. (or similar) The arrow direction shows who is talking to who - >>> is you talking, <<< is the other end talking.

3/23/98 10:09:18 AM : A connection to 157.54.190.98 was _ established.
3/23/98 10:09:18 AM : <<< IO: |220 lde32.DOMAIN.TLD Mi_ crosoft Exchange Internet Mail
Service 5.0.1460.8 ready
3/23/98 10:09:18 AM : <<< 220 lde32.DOMAIN.TLD Microsoft _ Exchange Internet Mail Service
5.0.1460.8 ready
3/23/98 10:09:18 AM : >>> EHLO mail.microsoft.com
3/23/98 10:09:18 AM : <<< IO: |250-lde32.DOMAIN.TLD _ supports the following extensions:
250-XAUTH
250-XEXCH50
250-HELP
250-VRFY
250-SIZE 0
250-ETRN
250 DSN
3/23/98 10:09:18 AM : >>> MAIL _ FROM:<Someone@MICROSOFT.com> SIZE=1393 RET=FULL
3/23/98 10:09:18 AM : <<< IO: |250 OK ? mail from _ <Someone@MICROSOFT.com>; can
accommodate 1393 bytes
3/23/98 10:09:18 AM : <<< 250 OK ? mail from _ <Someone@MICROSOFT.com>; can accommodate
1393 bytes
3/23/98 10:09:18 AM : >>> RCPT TO:<user@domain.tld> _ NOTIFY=FAILURE,DELAY
3/23/98 10:09:18 AM : <<< IO: |250 OK ? Recipient _ <user@domain.tld>
3/23/98 10:09:18 AM : <<< 250 OK ? Recipient _ <user@domain.tld>
3/23/98 10:09:18 AM : >>> DATA
3/23/98 10:09:19 AM : <<< IO: |354 Send data. End with _ CRLF.CRLF|
3/23/98 10:09:19 AM : <<< 354 Send data. End with _ CRLF.CRLF
3/23/98 10:09:19 AM : <<< IO: |250 OK
3/23/98 10:09:19 AM : <<< 250 OK
3/23/98 10:09:19 AM : >>> QUIT
3/23/98 10:09:19 AM : <<< IO: |221 closing connection

 

[crazycelicagts1]

yeah i forgot to stop and start the service again....its been on and waiting for it to make a log of my sented mail....its been like 20 minutes so i'll check it in a little bit.