Email Delivery Problem

[JohnE111]

Hello

I sent an email and 5 hours later I got a message back saying that Microsoft Exchange could not deliver my message - "Delivery Delayed".

Is this strange? I thought it would email me back within 10 minutes if a spam rule was triggered?

Also, I wonder if it is the clients Outlook that's blocking it or if its Exchange? or Messagelabs?

It seems to think my email is a newsletter scoring 50 hits with a required 7! I'm amazed if I'm reading that right, my email content and sending address are not remotely related to spam or newsletters.

Please see below, the header of the email I got from the postmaster@
I've edited the sender and recipient as I'm not sure if I am allowed to post those details.

Many thanks!


Received: from mail6.bemta4.messagelabs.com (85.158.143.247) by
internalmail.local (10.10.2.5) with Microsoft SMTP Server (TLS) id
8.1.436.0; Sat, 24 Mar 2012 16:09:20 +0000
Return-Path: <[sender]@gmail.com>
Received: from [85.158.143.99:64493] by server-3.bemta-4.messagelabs.com id
7B/35-05853-0B1FD6F4; Sat, 24 Mar 2012 16:09:20 +0000
Subject: SPAM: Urgent: cat stuck in tree
X-Env-Sender: [sender]@gmail.com
X-Msg-Ref: server-2.tower-216.messagelabs.com!1332605359!22294765!1
X-Originating-IP: [209.85.212.180]
X-Spam-Flag: YES
X-SpamInfo: spam detected heuristically
X-SpamReason: Yes, hits=50.0 required=7.0 tests=newsletters: ,
newsletters: Newsletter detected: 6.1 > 5,newsletters: Newsletter
detected: 6.1 > 5,Customer block: newsletter detected heuristically:
ML_RADAR_NL_1, ML_RADAR_NL_2Y, ML_RADAR_NL_2
X-StarScan-Version: 6.5.7;
banners=-,-,dcpm.co.uk
X-VirusChecked: Checked
Received: (qmail 25920 invoked from network); 24 Mar 2012 16:09:19 -0000
Received: from mail-wi0-f180.google.com (HELO mail-wi0-f180.google.com)
(209.85.212.180) by server-2.tower-216.messagelabs.com with RC4-SHA
encrypted SMTP; 24 Mar 2012 16:09:19 -0000
Received: by wibhm17 with SMTP id hm17so2645498wib.3 for
<[recipient]@dcpm.co.uk>; Sat, 24 Mar 2012 09:09:19 -0700
(PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20120113;
h=return-receipt-to:reply-to:from:to:subject:date:message-id
:mime-version:content-type:x-mailer:thread-index:x-mimeole
:disposition-notification-to;
bh=XwDWaMd3eD7tIDY+2AnW/L5kzuPDI+T7+bDdNlwxYPw=;
b=aTocWnjG4KaanVEPSHTxXnx15/FgSGN30IccBXnaWiqreeDU57MY8nHhJ8eI8ys3yr
u1cg+ZnZarGBlkxy4qcrlIGvFcqo0+CAKYxXAG0KPThrLHjEHVSVquhlkThzN/t//bKv
SxmWdwzPO84Zg2x5j+wCU0sy6gPpwvRuNFj1Cg1P9SIhOo9nAIZbggFrr4dpmnBm9h8r
/frXL8hSOVvUEleiD1T+j7HqDVcuJAE8dHjf2sNwzit008zQyrEF73EmXk/nUDnRtEL1
WCurThEJkeNrC/lMsoqr8yyE2tvs+WKz4IuUzOhQ3h6MNdKrmqLqEXc+u00viISMmHGj
YSjA==
Received: by 10.180.89.9 with SMTP id bk9mr5738131wib.11.1332605359393;
Sat, 24 Mar 2012 09:09:19 -0700 (PDT)
Received: from mypc (1.1.1.1) by
mx.google.com with ESMTPS id 9sm39447745wid.2.2012.03.24.09.09.14
(version=SSLv3 cipher=OTHER); Sat, 24 Mar 2012 09:09:18 -0700
(PDT)
Return-Receipt-To: "John" <[sender]@gmail.com>
Reply-To: <[sender]@gmail.com>
From: John <[sender]@gmail.com>
To: <[recipient]@dcpm.co.uk>
Date: Sat, 24 Mar 2012 16:08:34 +0000
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAXNeqIC2LD0uFmC+18iIcd8KAAAAQAAAAWW5oRmfuw0SKj3+b0t+MPAEAAAAA@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0008_01CD09D8.62F4AAC0"
X-Mailer: Email Client


[moderator:] e-mail addresses removed from post

[janusz]

My generic guess (TM ) is that this has nothing to do with spam & the delay was caused by let's say a connectivity problem. MS Exch could not connect to the target site for 5 hours.

Possible causes : target site down, email server at the target site crashed.

It's usual for the sender site/server (MS Exch in your case) to keep trying for a few days before finally giving up. There is very little you can do, short of alerting the target site's admin/postmaster.by some other (non-email) means.

[n5bb]

Welcome to the EMD Forums, JohnE111!

As janusz said, there are various possibilities, given the limited information we have available. It's obvious that this message was marked as newsletter spam, so I think it's logical to assume that spam filtering might have something to do with the 5 hour delay you saw. But you only sent the headers of the message you sent which was received at the destination server, and it was delivered quickly:

• Date header: Sat, 24 Mar 2012 16:08:34 +0000 == Your email client created this timestamp based on the clock in your PC.
• First server reception header: Sat, 24 Mar 2012 09:09:18 -0700
  (PDT) == This was the timestamp when received at the first Google SMTP server, 44 seconds later. This delay might be due to your PC clock being set incorrectly or a large message sent over a slow ISP network connection.
• Messagelabs server reception header: 24 Mar 2012 16:09:19 -0000 == One second later the email arrived at the offsite spam filtering service.
• Received at destination: Sat, 24 Mar 2012 16:09:20 +0000 == One second later (after spam filtering) the email arrived at the destination (which I assume is the dcpm.co.uk domain).

You didn't send the delivery delay message headers or content, so we don't know which end sent it to you. And we don't know if you or the recipient (or both) is using Exchange, so we can't guess where that delivery message came from. The 5 hour delay might have been a problem with your email system not quickly delivering the delivery message from Exchange!

Here is what I suggest to resolve the apparent delay issue:

• Find your copy of the original email you sent (in your Sent Items or other similar folder in your email client). Does the Date header in that message show Sat, 24 Mar 2012 16:08:34 +0000? And does that agree with the time you remember sending the email?
• If this is the first time in recent memory you have sent a message to that recipient, the delay might be greylisting. This is a spam reduction technique where the destination server temporarily refuses the message, but the sending server tries again later and the message is delivered properly. Spam typically doesn't retry in this manner. So if you are using Exchange to send the message, it might be reporting a delay due to greylisting.
• The Google timestamps are 7 hours behind yours in the UK. So you have to take the -0700 timezone offset in account (by adding 0700 to the Google timestamps) to compare again the GMT timezone (+0000 offset).
• Look at the headers and content of the Message Delayed email (and post it here if you wish).
• The destination email system might be forwarding your message to another email system. If that forwarding is failing for some reason, you may get such delayed delivery warning messages.
• The destination email system might be deferring delivery due to the spam classification.

Your email might be classified as spam based on various characteristics. Since the headers you posted tells us that the reason was "spam detected heuristically", we know that the problem might be due to some of the following:

• The subject of the message. "Urgent: cat stuck in tree" might be a common funny story which the spam filtering service blocks (just like certain newsletters). Many companies are now trying to block their employees receiving non-work email through their work accounts, and so filter such content.
• The body of the message. Besides matching common spam, newsletters, or funny stories as I described above, certain attachments or other content (such as Visual Basic script) can cause a message to be blocked.
• The end user, their employer, their email service, or messagelabs might be blocking you (or some or all messages sent from Gmail).

Try the following:

• Send a short simple email (with a subject which does not look like spam and with no attachments) to that person. Does it arrive quickly with no warnings?
• Ask the recipient to whitelist your email address. This is usually done by placing your email address in their address book or some other list of good email addresses.
• Test multiple times if you want to be sure you can reliably reach that recipient.

Bill

[William9]

Great, constructive response Bill.

[sinsay]

very usefull, thanks.