Hello , I have a big problem If someone from outside send two mails I receive just one. But in SMTP receive log its appear as receivet, but in my inbox it will not appear. If I use Message Tracking Center it appear just first of its. The sender server says the messages are delivered. What can be ?

Did you check your junk mail? What version of Outlook are you using? If you have conversation view enabled maybe you need to check the full thread. Also make sure you don't have any filters enabled. Jorge R. Diaz, PMP, CCNA, MCSA, MCSE Senior Microsoft Consultant Planet Technologies, Inc. Check out My Blog!

Not in junk . Outlook 2010 . Not conversation view enabled. There are some of my collegue that claims the same problem. Some mails come into their mailbox another are not (from the same sender) What filter can be activated ? In my smtp receive log are all the mails... but not in mailboxes ? ???

Duplicate Message Detection? http://technet.microsoft.com/en-us/library/dd577073(EXCHG.80).aspx I had a problem where an internal recipient would e-mail 3 different lists on an external listserv, the same post, and he was subscribed to all 3. He only got one message back though, the other 2 were deleted as duplicates.

Good call! Jorge R. Diaz, PMP, CCNA, MCSA, MCSE Senior Microsoft Consultant Planet Technologies, Inc. Check out My Blog!

Is not the case. The mail was send only to me, not to a distribution list. that make me crazy ....

It doesn't have to involve a distribution list. If you are running Exchange 2007, Duplicate Message Detection is on. From my memory of it, when you do message tracking, it will show those messages being delivered to the message store. The store checks for duplicates once the message is deivered.

What shoud I do ? Duplicate Message Detection cannot be turned off in Microsoft Exchange.

To clairfy the issue, this happens when anyone from outside sends you two emails or just this one user? How are they sending you the emails ie. user creates one email clicks send, user creates another email clicks send? Are you the only one on the email? Please describe the details.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Some users from sales deptartment complains that some mails from certain partners arrive in their mailbox another mails from same partners does not, althougt they know for sure that the mail was sent by partner. I have checked in smtp logs and I have found two mails from one sender to my sales coleague. In his mailbox is just one mail (we have checked on webmail too, to eliminate outlook issue). The second one is nowhere.. I am not sure how the sender send mails... I will find out and I will return with details. On exchange server Ihave installed kaspersky antivirus for exchange server... but nothing suspect seems to be in kaspesky configuration. thank you.

Here is an example mail header: this mail it was expected to be delivered to adorian.demeter; catalin.rosu and alexandru.parlea the only one who received the mail was alexandru.parlea@myrpc.ro this domain is also hostet on my mail server. This mail was send once by a partner to three people in my organization, but only one receive it. Received: from acroxadd.acrox.local (192.168.100.10) by RHSExchange.rhs.lan (192.168.100.21) with Microsoft SMTP Server id 8.3.106.1; Fri, 11 Feb 2011 13:06:42 +0200 Received: from OEMSunny ([192.168.1.20]) by acroxadd.acrox.local with Microsoft SMTPSVC(6.0.3790.4675); Fri, 11 Feb 2011 19:00:38 +0800 From: Nora <nora@acrox.com.tw> To: 'Adorian Demeter' <adorian.demeter@rhs.ro> CC: 'Catalin Rosu' <catalin.rosu@myrpc.ro>, ''Judy Lee'' <judylee@acrox.com.tw>, 'Winnie' <winniechang@acrox.com.tw>, 'Alexandru Parlea' <Alexandru.Parlea@rhs.ro> Subject: [SPAM] RE: Samples I just received [SPAM+] Date: Fri, 11 Feb 2011 19:04:14 +0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_005A_01CBCA1E.79ECE8F0" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Thread-Index: AcvDsNcTsSBu6egOR56fNS2vyzF1rADkTYqQAEW9G9AAGzTqYAAPkVIwADLONrA= In-Reply-To: <EE4F89ED76238A41AF5531EEC87DA3513D83A10BB9@RHSExchange.rhs.lan> Return-Path: nora@acrox.com.tw Message-ID: <ACROXADDwD43oFLaqSO000000f5@acroxadd.acrox.local> X-OriginalArrivalTime: 11 Feb 2011 11:00:38.0105 (UTC) FILETIME=[EA4B5490:01CBC9DA] X-BitDefender-SpamStamp: v1, build 2.8.85.128428, fuzzy gen, rbl score: 0(0), total: 1000(775) X-BD-GateRHS-Spam: Yes (1000) X-BitDefender-EV: 7.36180

Could this event Id to be the cause? In event viewer I found this event ID 12014 Microsoft Exchange could not find a certificate that contains the domain name ***.domain.ro in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector dcems with a FQDN parameter of ***.domain.ro. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.

xLeeH this is a good information. Thanks for sharing.

If you message track the message-id, it doesn't show the other recipients with the status of 250.2.1.5 recipient ok?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Look below an example from SMTP receive logs: Costi.Neacsu@rhs.ro complains that the mail send from dragos.sima@star-storage.ro did not arrive in his mailbox. What could be the reason ? 192.168.100.10 is a server with antispam filter 192.168.100.21 is exchange server mail flow from 192.168.100.10 to 192.168.100.21 2011-02-14T11:00:22.800Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,0,192.168.100.21:25,192.168.100.10:16887,+,, 2011-02-14T11:00:22.800Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,1,192.168.100.21:25,192.168.100.10:16887,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions 2011-02-14T11:00:22.800Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,2,192.168.100.21:25,192.168.100.10:16887,>,"220 RHSExchange.rhs.lan Microsoft ESMTP MAIL Service ready at Mon, 14 Feb 2011 13:00:21 +0200", 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,3,192.168.100.21:25,192.168.100.10:16887,<,EHLO mail.star-storage.ro, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,4,192.168.100.21:25,192.168.100.10:16887,>,250-RHSExchange.rhs.lan Hello [192.168.100.10], 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,5,192.168.100.21:25,192.168.100.10:16887,>,250-SIZE, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,6,192.168.100.21:25,192.168.100.10:16887,>,250-PIPELINING, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,7,192.168.100.21:25,192.168.100.10:16887,>,250-DSN, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,8,192.168.100.21:25,192.168.100.10:16887,>,250-ENHANCEDSTATUSCODES, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,9,192.168.100.21:25,192.168.100.10:16887,>,250-STARTTLS, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,10,192.168.100.21:25,192.168.100.10:16887,>,250-X-ANONYMOUSTLS, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,11,192.168.100.21:25,192.168.100.10:16887,>,250-AUTH NTLM LOGIN, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,12,192.168.100.21:25,192.168.100.10:16887,>,250-X-EXPS GSSAPI NTLM, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,13,192.168.100.21:25,192.168.100.10:16887,>,250-8BITMIME, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,14,192.168.100.21:25,192.168.100.10:16887,>,250-BINARYMIME, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,15,192.168.100.21:25,192.168.100.10:16887,>,250-CHUNKING, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,16,192.168.100.21:25,192.168.100.10:16887,>,250-XEXCH50, 2011-02-14T11:00:22.808Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,17,192.168.100.21:25,192.168.100.10:16887,>,250 XRDST, 2011-02-14T11:00:23.038Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,18,192.168.100.21:25,192.168.100.10:16887,<,MAIL FROM:<dragos.sima@star-storage.ro> SIZE=358215, 2011-02-14T11:00:23.038Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,19,192.168.100.21:25,192.168.100.10:16887,*,08CD9766E7E67331;2011-02-14T11:00:22.800Z;1,receiving message 2011-02-14T11:00:23.038Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,20,192.168.100.21:25,192.168.100.10:16887,>,250 2.1.0 Sender OK, 2011-02-14T11:00:23.049Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,21,192.168.100.21:25,192.168.100.10:16887,<,RCPT TO:<Costi.Neacsu@rhs.ro>, 2011-02-14T11:00:23.049Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,22,192.168.100.21:25,192.168.100.10:16887,>,250 2.1.5 Recipient OK, 2011-02-14T11:00:24.576Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,23,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:29.580Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,24,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:29.580Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,25,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:34.589Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,26,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:34.589Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,27,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:39.583Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,28,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:39.583Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,29,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:44.588Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,30,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:44.588Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,31,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:49.584Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,32,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:49.584Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,33,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:54.580Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,34,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:54.580Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,35,192.168.100.21:25,192.168.100.10:16887,<,bdat 32768 , 2011-02-14T11:00:59.587Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,36,192.168.100.21:25,192.168.100.10:16887,>,"250 2.6.0 CHUNK received OK, 32768 octets", 2011-02-14T11:00:59.587Z,RHSEXCHANGE\Default RHSEXCHANGE,08CD9766E7E67331,37,192.168.100.21:25,192.168.100.10:16887,-,,Remote

This Event ID could cause loosing some mails that are received by SMTP ? Event Id 12014 Error Source MSExchangeTransport Microsoft Exchange could not find a certificate that contains the domain name gate.rhs.ro in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector dcems with a FQDN parameter of gate.rhs.ro. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key. Thank you .

No it shouldn't that only affects outbound, not inbound messages. The inbound message is being chunked but it hasn't received the last chunk or you haven't provided the entire log for this transaction. It could be some issue with chunking (breaking the message in pieces) either on your end or sender's end; could be firewall or other reasons. You can try disabling chunking on the connector for a few days to see if you notice any improvement until you can find the root cause. Set-ReceiveConnector -Identity "nameofconnector" -BinaryMimeEnabled $False Set-ReceiveConnector -Identity "nameofconnector" -Chunking $False James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

The log is complete, I have cheked again. Why another mails are not chunking ? It seems only these mails whitch are chunking are missing. I have send a mail from my gmail account and it is received corectly without chunking in SMTP logs. thanks.

I'm not sure, do you if the missing emails are always from this domain or random?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

how did you find out that is missing the last chunk , in previous smtp log ? tks.

Yes your logs do not show bdat last indicating that he sending server is finished sending the data. Is this only happening from this domain or random domains?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

It is not hapening only from this domain, there are few domains with this problem. Recently I have reinstall ISA 2004 with sp2 ... it is possibile to be some wrong configured on ISA ? thx

Yes it's possible, Firewalls can cause issues with enhanced SMTP verbs such as BDAT.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Hmm... I have restored ISA from backup, and previous configuration worked fine... this make me crazy !

I have ISA 2004 with SP2 I found on microsoft website an overview about ISA2004 sp2: read the last point.. do you think it is a must tu install sp3 on isa 2004 ? Overview Internet Security and Acceleration (ISA) Server 2004 SP3 provides the latest updates to ISA Server 2004 Standard Edition, with increased security, enhanced troubleshooting tools, and improved log viewer functionality. This service pack also adds support for publishing Microsoft Exchange Server 2007 with ISA Server 2004. We strongly recommend customers install ISA Server 2004 SP3 on all computers running ISA Server 2004. ISA Server 2004 Standard Edition SP3 can be installed directly on computers running ISA Server 2004 Standard Edition, and includes: • All software updates issued since ISA Server 2004 was released to manufacturing. • Fixes for common issues reported by customers through Microsoft Customer Service and Support. • Improved log viewer functionality, including an enhanced details pane view, text coloring, and new log filtering functionality. • Updated ISA Server Microsoft Management Console (MMC) snap-in functionality that provides access to troubleshooting tools and options available directly from the ISA Server Management console. • Integration with the Microsoft ISA Server Best Practices Analyzer Tool. For more information, see http://go.microsoft.com/fwlink/?LinkId=79754. • New diagnostic logging functionality. • Support for publishing computers running Microsoft Exchange Server 2007 both to receive and send Internet e-mail messages.

Sounds crazy....But finally got fixed by restore.. ;)Gulab | MCTS-MCITP: 2007 | MCTS-MCITP: 2010 | Skype: gulab.mallah

Gulab... what sounds crazy ? my issue ?

YES....Gulab | MCTS-MCITP: 2007 | MCTS-MCITP: 2010 | Skype: gulab.mallah

I tell you man.... am out of ideeas ISA 2004 sp3 is the last bullet.

I would suggest that you should move on to TMG 2010 after the resolution, monitor it for a while and than move on to TMG 2010. ISA 2004 ancient ;)Gulab | MCTS-MCITP: 2007 | MCTS-MCITP: 2010 | Skype: gulab.mallah

Is isa installed on the Exchange server or separate?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Isa and exchange are on separate machines. I had run: Set-ReceiveConnector -Identity "nameofconnector" -BinaryMimeEnabled $False Set-ReceiveConnector -Identity "nameofconnector" -Chunking $False and it seems work now... I will monitor this problem next few days... but why last week worked and after reinstalling isa this problem occur ? anyway... thanks all of you for answers.

I'm not too familiar with ISA, but make sure your SMTP filter in ISA is allowing BDAT. Also you may have to up the maximum length limit as well.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com