Email being dropped by CASE for one user but not others

[diabetesvic]

Hi All,

I seem to be having a problem with our IronPort device. I have an email that comes from a external media site that gets sent to 4 email address which are all within about 15 minutes of each other. Now (seems to be random) some users will have the email dropped due to CASE and other will recieve the exact same email message. This happens to different uses ( so one day the user will get the email but the next day they don't)

I can't seem to see what they problem would be, does anyone have any suggestions on how to fix this?

Thanks

[Doug Maxfield]

Have you checked your mail logs to see if maybe the sender is "round-robining" the mail through multiple server and only 1 server is causing the problem?  We have seen this before with a couple of senders.

Doug

[diabetesvic]

Hi Doug,

Yes i've checked this and they are all coming from the same address, looking back over the logs i can see that this only started happening at the start of the April. But that being said it's hasn't occurred again for the last 3 days maybe it's been fixed? i'll keep a eye on it anyway.

Thanks for your help

[Andreas Mueller]

Hi Peter,

just as an addition, this is how I usually approach problems like this. First step is to check the logs of the different messages, and compare if there are any differences in the following details:

- Sendergroup

- Mail Policy

- Anything related to LDAP (masquerading, rerouting, etc).

Also, if the network consits of ESAs running centralized management (cluster), I also check the config for any machine specific configuration.

So basically the same you did already by confirming that the sender IP is always the same. But also check the mail policies the messages hit, especial if they are configured differently for antispam.

Hope that helps,

Andreas