Email Connection Lost

[Ali]

Hi Community,

Below is the attached Message tracking details.

In message tracking it is showing Incoming connection has lost and the next line it is going for the next email pipeline scanning engine and at the end it started DCID connection to the exchange for the delivery and it has successfully delivered the message to the exchange.

End user is reporting he has not received the email.

From exchange it is showing as delivered, When the sender sends the same mail again same thing showing in Message tracking ICID lost for the specific sender(X) to recipient(Y) when he again sends the same email.

Your inputs would be highly appreciated. 

When it is showing ICID lost in Message Tracking why it still going for the next email pipeline for scanning  ? 

[Libin Varghese]

Seeing ICID lost in the tracking typically happens when either the ESA loses the connection, or the sending client prematurely ends the connection without sending us the entire message.

Setting up a packet capture for the sender IP or injection debug logs should help confirm the same.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118579-qa-esa-00.html

However, whatever information was received by the ESA would have been delivered to the destination server using the delivery connection (DCID) so if the end user did not receive the email it would need to be confirmed on the exchange IP listed on the DCID.

Regards,

Libin Varghese

[Ali]

@Libin Varghese
Thank You for the reply and information provided.

In Message Tracking we can see that DCID connection has been open from IronPort interface to the Exchange Server IP also received the SMTP 2.6.0 response from Exchange.

So even if the message is lost what exactly information does ESA sent to the Exchange to complete the message even if the ESA loses the connection, or the sending client prematurely ends the connection without sending us the entire message.

[Libin Varghese · Accepted solution]

Since a MID is created the ESA did receive DATA and whatever was received would be relayed to the exchange server.

The connection used to inject that data to the ESA can be closed by the sending server before the ESA finishes processing the email, hence its logged before the DCID is created.