Ironport - Out of office messages

slizarraga · ‎11-22-2011

I have some trouble with the out of office messages. A succesfull first e-mail is send to a user and an Out of Office automatic message is send back by the Exchange Server.

First it is send to the Ironport and the Ironport doesn´t send it to the user (Internet); this is the result of the tracking:

Received Time:	21 Nov 2011 18:15:05 (GMT -05:00)
MID:	3031944
Message Size:	1.7 (KB)
Subject:	Respuesta de Estoy ausente: Status de envios
Envelope Sender:	(no sender)
Envelope Recipients:	gcaviedes@pe.ibm.com
Message ID Header:	<b6d3e845d5784b7487e4aa12d8fc45eb@TICLMOCS03.fonafe.pvt>
SMTP Auth User ID:	N/A

21 Nov 2011 18:15:05 (GMT -05:00) Protocol SMTP interface out-fonafe-compartido (IP 10.110.8.23) on incoming connection (ICID 5527883) from sender IP 10.110.2.102. Reverse DNS host None verified no.

21 Nov 2011 18:15:05 (GMT -05:00) (ICID 5527883) RELAY sender group RELAYLIST match 10.110.2.102 SBRS not enabled

21 Nov 2011 18:15:05 (GMT -05:00) Start message 3031944 on incoming connection (ICID 5527883).

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 enqueued on incoming connection (ICID 5527883) from .

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 on incoming connection (ICID 5527883) added recipient (gcaviedes@pe.ibm.com).

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 contains message ID header '<b6d3e845d5784b7487e4aa12d8fc45eb@TICLMOCS03.fonafe.pvt>'.

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 original subject on injection: Respuesta de Estoy ausente: Status de envios

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 (1737 bytes) from ready.

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 matched per-recipient policy Fonafe Compartido for outbound mail policies.

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 scanned by Anti-Virus engine Sophos. Interim verdict: CLEAN

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 scanned by Anti-Virus engine. Final verdict: Negative

21 Nov 2011 18:15:05 (GMT -05:00) Message 3031944 queued for delivery.

y compared it with a succesfull message (not an "Out of Office") and the diference is that after this log messages, the succesfull ones continue with these:

22 Nov 2011 07:28:26 (GMT -05:00) SMTP delivery connection (DCID 9032063) opened from IronPort interface 10.110.8.23 to IP address 200.60.223.71 on port 25.

22 Nov 2011 07:28:27 (GMT -05:00) (DCID 9032063) Delivery started for message 3098744 to edavalos@tgestiona.com.pe, JCahuana@tgestiona.com.pe.

22 Nov 2011 07:28:30 (GMT -05:00) (DCID 9032063) Delivery details: Message 3098744 sent to edavalos@tgestiona.com.pe, JCahuana@tgestiona.com.pe

22 Nov 2011 07:28:30 (GMT -05:00) Message 3098744 to edavalos@tgestiona.com.pe, JCahuana@tgestiona.com.pe received remote SMTP response ' : Message accepted for delivery'.

anyway, I get no drop or quarentine log.

Do you know where should I check? It looks like messager are drop.

Thanks for your help!

Andreas Mueller · ‎11-24-2011

Hello slizarraga,

when the logs show a "queued for delivery" without any further lines afterwards (DCID or bounce), then this always means the message is still waiting to be delivered. Most likely reason is that the recipient host is down, you can confirm that on the CLI by using tophosts and hoststatus for the domain in question, or on the GUI under Monitor->Delivery Status. In both cases, look for the host status to show "down", or a larger number of active recipients to indicate a problem on delivery. In your case the host in question would be "pe.ibm.com", so. i.e a

CLI: hoststatus

pe.ibm.com

should reveal more details. It will also show you if the destination uses an smtp route to redirect to a different destination IP. In either way, host status "unknown" or "down" indicates delivery problems that you'd need to indicate further.

Also, with the mail now being three days old, it should probably bounce soon.

Hope that helps,

Andreas