We have two Exchange organizations that are connected by a mail router called ModusGate made by Vircom. The mail router is just that, it simply routes email, it is not a mail server with mailboxes. The Exchange organization that works fine has an Exchange 2003 server as the primary, and an Exchange 2010 server that is not being used. The Exchange organization that is having issues only has an Exchange 2003 server. We have recently discovered that when sending email to over 65 users of one of the Exchange organizations, the sender receives a message delayed NDR, status code 2.1.5. Looking at the logs on the mail router, it looks like the Exchange server is just dropping the connection. I have already checked the Recipient Limits in the Message Delivery Properties in ESM. I have also checked the Limit number of recipients under the SMTP Virtual Server Properties in ESM. Again, this only happens to one of the Exchange organizations, not the other. It only happens when sending to over 65 recipients.

If you are seeing what looks like the traffic dropping on Exchange, then it is the next hop that is rejecting the message. That would be that mail router product. If the email was rejected by Exchange for any other reason, then it would hard fail, not delay fail. Therefore I would be pointing the finger firmly at the mail router product or some other third party product that could be installed on the server that is interfering with the SMTP traffic. I have seen firewalls do similar things as well. The behaviour you have identified is not something I have seen Exchange do. Simon.Simon Butler, Exchange MVP Blog | Exchange Resources

I did work with the mail router company for two days on this, and we were unable to find anything. An example of this failure would be, I send an email to all users in that Exchange organization. I trace the message in the logs and see my Exchange organization hand it to the mail router. I then see in the logs the mail router connect to the other Exchange organization and begin delivering messages. After 65 messages have been delivered, the mail router logs this message, "*** Intermediate LogID [14281738] will be continued later. ***", then I get several of these, "met error 'I/O write error encountered: 'The specified network name is no longer available.', code 0x00000040' while sending.", however shortly after that, the rest of the messages are delivered. The problem whenever our users or our customers send these messages to all users at that project, they receive a delay NDR, and it looks like our system is broken, even though the messages are eventually delivered. Here are a couple of errors I've found in the event logs. Not sure if they're related. The name of this Exchange server is MAIL. Event Type: Error Event Source: MSExchangeFBPublish Event Category: General Event ID: 8213 Date: 1/3/2011 Time: 7:16:07 AM User: N/A Computer: MAIL Description: System Attendant Service failed to create session for virtual machine MAIL. The error number is 0xc007052e. For more information, click http://www.microsoft.com/contentredirect.asp. Event Type: Warning Event Source: MSExchangeSA Event Category: General Event ID: 9160 Date: 1/3/2011 Time: 9:03:11 AM User: N/A Computer: MAIL Description: Microsoft Exchange System Attendant has detected that the password of the legacy exchange service account has been modified. System Attendant needs to restart the Microsoft Exchange Free Busy Publishing Service. For more information, click http://www.microsoft.com/contentredirect.asp. Event Type: Error Event Source: ESE Event Category: Logging/Recovery Event ID: 454 Date: 1/3/2011 Time: 9:05:16 AM User: N/A Computer: MAIL Description: MSExchangeSRS (4724) SRS Storage: Database recovery/restore failed with unexpected error -1216. For more information, click http://www.microsoft.com/contentredirect.asp. Event Type: Error Event Source: MSExchangeDSAccess Event Category: LDAP Event ID: 2061 Date: 1/4/2011 Time: 9:46:52 AM User: N/A Computer: MAIL Description: Process MAD.EXE (PID=2832). An LDAP search call failed - Server=domaincontroller.domain.com Error code=80040957. Base DN=, Filter=(legacyExchangeDN=), Scope=2. For more information, click http://www.microsoft.com/contentredirect.asp.

None of the errors that you have posted will have anything to do with email delivery. The only exception could be the last one, which could be an indication of Exchange having problems seeing the domain. You also shouldn't be seeing anything connected to SRS - as that is for Exchange 5.5 interoperability only. Not used by a native Exchange 2003 platform. Do you have Exchange running in a service account? Again that was an Exchange 5.5 thing. Exchange 2003 shouldn't be using a named account. Given the errors that you have posted have identified a number of configuration issues with the server, I would probably suggest that you run the Exchange Best Practises analyser. There is a link to the download on my Exchange Resources site in my signature. That might flat other issues that are the cause of the problem, although unlikely. Although I still suspect the mail routing device. Have you bypassed it to prove it isn't the cause of the problem. Surprised that they have worked on it for two days, as most vendor tech support operate a standard practise - find something else to blame it on and then close the call. In this case they would blame Exchange. Simon.Simon Butler, Exchange MVP Blog | Exchange Resources

Thank for the suggestions. I ran the Best Practices Analyzer and surprisingly, there weren't too many issues, and none seem related to this. I can't comment too much on the configuration of that Exchange server either. Our company recently acquired this project and this is the Exchange server they already had. One of my coworkers assumed IT responsibility for this site and I haven't dealt with it much. I administer the Exchange organization for our main site, and the mail router device, but I do have access to that other Exchange server. The vendor of the mail router did give up on the second day, though the issue was escalated all the way to their developers and they couldn't find anything wrong. They did blame it on Exchange, just as you said. The fact that the mail router does deliver messages and a network I/O error causes a delay seems to point towards the receiving end, which is the Exchange server. Currently the issue is believed to be with the remote Exchange server, however I'm not saying I believe this to absolutely be the case. I should be able to setup a direct SMTP connector between the two servers later this evening and try to test.

I setup the SMTP connector where the Exchange servers in each organization talk directly to one another, bypassing the mail router. Doing this resulted in no errors, everything worked correctly. I reopened the ticket with the mail router company putting the issue back on them, and after a couple of hours troubleshooting, they claimed the issue is network latency. Ping times from the mail router to the other Exchange server average around 75ms, going through a firewall and a VPN tunnel. It appears that the mail router is trying to deliver the mail faster than the network can transmit it; that's the conclusion that the support person came up with anyway. We don't experience this issue with a large number of email addresses going to our main Exchange server, and it is on the same switch as the mail router, so latency is less than 1ms. So at this point, I guess we're handling it as a network issue. Since the remote Exchange server does accept the messages and deliver them, I don't believe there is an Exchange issue. Thanks for the help.