none
Can't receive/Delayed pdf attachments of more than 100kb from a few different contacts

    Question

  • I have two customers who can't send me pdf attachments larger than 100kb without them failing or being delayed up to 24hours. Everyone else can send the same or larger attachments through just fine.

    Things I have tried to fix the problem :

    Disable spam filtering

    Disable tarpitting

    increase timeout to 2:30:00

    Verify MTU is set correctly

    Whitelist the IP Address of the sender

    Some logs of a file that didn't go through:

     

    2016-01-25T21:37:47.387Z,EXCHANGE01\Default EXCHANGE01,address,0,10.0.1.19:25,x.x.x.x:60062,+,,

    2016-01-25T21:37:47.387Z,EXCHANGE01\Default EXCHANGE01,address,1,10.0.1.19:25,x.x.x.x:60062,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions

    2016-01-25T21:37:47.402Z,EXCHANGE01\Default EXCHANGE01,address,2,10.0.1.19:25,x.x.x.x:60062,>,"220 exchange01.domain.local Microsoft ESMTP MAIL Service ready at Mon, 25 Jan 2016 15:37:46 -0600",

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,3,10.0.1.19:25,x.x.x.x:60062,<,EHLO Zixserver,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,4,10.0.1.19:25,x.x.x.x:60062,>,250-exchange01.domain.local Hello [x.x.x.x],

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,5,10.0.1.19:25,x.x.x.x:60062,>,250-SIZE,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,6,10.0.1.19:25,x.x.x.x:60062,>,250-PIPELINING,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,7,10.0.1.19:25,x.x.x.x:60062,>,250-DSN,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,8,10.0.1.19:25,x.x.x.x:60062,>,250-ENHANCEDSTATUSCODES,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,9,10.0.1.19:25,x.x.x.x:60062,>,250-STARTTLS,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,10,10.0.1.19:25,x.x.x.x:60062,>,250-X-ANONYMOUSTLS,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,11,10.0.1.19:25,x.x.x.x:60062,>,250-AUTH NTLM,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,12,10.0.1.19:25,x.x.x.x:60062,>,250-X-EXPS GSSAPI NTLM,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,13,10.0.1.19:25,x.x.x.x:60062,>,250-8BITMIME,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,14,10.0.1.19:25,x.x.x.x:60062,>,250-BINARYMIME,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,15,10.0.1.19:25,x.x.x.x:60062,>,250-CHUNKING,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,16,10.0.1.19:25,x.x.x.x:60062,>,250-XEXCH50,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,17,10.0.1.19:25,x.x.x.x:60062,>,250-XRDST,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,18,10.0.1.19:25,x.x.x.x:60062,>,250 XSHADOW,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,19,10.0.1.19:25,x.x.x.x:60062,<,STARTTLS,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,20,10.0.1.19:25,x.x.x.x:60062,>,220 2.0.0 SMTP server ready,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,21,10.0.1.19:25,x.x.x.x:60062,*,,Sending certificate

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,22,10.0.1.19:25,x.x.x.x:60062,*,CN=exchange01,Certificate subject

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,23,10.0.1.19:25,x.x.x.x:60062,*,CN=exchange01,Certificate issuer name

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,24,10.0.1.19:25,x.x.x.x:60062,*,****,Certificate serial number

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,25,10.0.1.19:25,x.x.x.x:60062,*,****,Certificate thumbprint

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,26,10.0.1.19:25,x.x.x.x:60062,*,exchange01;exchange01.domain.local,Certificate alternate names

    2016-01-25T21:37:47.543Z,EXCHANGE01\Default EXCHANGE01,address,27,10.0.1.19:25,x.x.x.x:60062,*,,"TLS protocol SP_PROT_TLS1_0_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_128 with strength 128 bits, MAC hash algorithm CALG_SHA1 with strength 160 bits and key exchange algorithm CALG_RSA_KEYX with strength 2048 bits"

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,28,10.0.1.19:25,x.x.x.x:60062,<,EHLO server,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,29,10.0.1.19:25,x.x.x.x:60062,*,,TlsDomainCapabilities='None'; Status='NoRemoteCertificate'

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,30,10.0.1.19:25,x.x.x.x:60062,>,250-exchange01.domain.local Hello [x.x.x.x],

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,31,10.0.1.19:25,x.x.x.x:60062,>,250-SIZE,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,32,10.0.1.19:25,x.x.x.x:60062,>,250-PIPELINING,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,33,10.0.1.19:25,x.x.x.x:60062,>,250-DSN,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,34,10.0.1.19:25,x.x.x.x:60062,>,250-ENHANCEDSTATUSCODES,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,35,10.0.1.19:25,x.x.x.x:60062,>,250-AUTH NTLM LOGIN,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,36,10.0.1.19:25,x.x.x.x:60062,>,250-X-EXPS GSSAPI NTLM,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,37,10.0.1.19:25,x.x.x.x:60062,>,250-8BITMIME,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,38,10.0.1.19:25,x.x.x.x:60062,>,250-BINARYMIME,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,39,10.0.1.19:25,x.x.x.x:60062,>,250-CHUNKING,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,40,10.0.1.19:25,x.x.x.x:60062,>,250-XEXCH50,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,41,10.0.1.19:25,x.x.x.x:60062,>,250-XRDST,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,42,10.0.1.19:25,x.x.x.x:60062,>,250 XSHADOW,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,43,10.0.1.19:25,x.x.x.x:60062,<,MAIL FROM:<****> SIZE=278779,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,44,10.0.1.19:25,x.x.x.x:60062,*,address;2016-01-25T21:37:47.387Z;1,receiving message

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,45,10.0.1.19:25,x.x.x.x:60062,<,RCPT TO:<recipient@domain.net> ORCPT=rfc822;*****@*****,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,46,10.0.1.19:25,x.x.x.x:60062,<,DATA,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,47,10.0.1.19:25,x.x.x.x:60062,>,250 2.1.0 Sender OK,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,48,10.0.1.19:25,x.x.x.x:60062,>,250 2.1.5 Recipient OK,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,49,10.0.1.19:25,x.x.x.x:60062,>,354 Start mail input; end with <CRLF>.<CRLF>,

    2016-01-25T21:37:47.683Z,EXCHANGE01\Default EXCHANGE01,address,50,10.0.1.19:25,x.x.x.x:60062,-,,Remote

    Tuesday, January 26, 2016 10:30 PM

All replies

  • Hi,

    Before going further, I’d like to ask the following questions to narrow down the issue :

    1. Is this problem only occurs when attachment is pdf file, how about txt or word file?
    2. Is there any NDR at customer side when email sent failed?
    3. Check message tracking log to identify which phase that email sending got stuck or blocked.

    You can access to the link below for more details about Message tracking log:

    https://technet.microsoft.com/en-us/library/bb124375(v=exchg.150).aspx


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    • Edited by Roger Lu Wednesday, January 27, 2016 10:54 AM
    Wednesday, January 27, 2016 10:53 AM
  • Hi,

    Please also provide the message headers for an email that you've received with a 24hr delay. You can get this from Outlook. This will help work out which SMTP server caused the delay as the delay could be at the sender's mail server.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:    Twitter:   

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Wednesday, January 27, 2016 12:21 PM
  • This one was delayed about 8 hours

     

    2016-01-25T21:37:47.387Z,EXCHANGE01\Default EXCHANGE01,address,0,10.0.1.19:25,x.x.x.x:60062,+,,

    2016-01-25T21:37:47.387Z,EXCHANGE01\Default EXCHANGE01,address,1,10.0.1.19:25,x.x.x.x:60062,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions

    2016-01-25T21:37:47.402Z,EXCHANGE01\Default EXCHANGE01,address,2,10.0.1.19:25,x.x.x.x:60062,>,"220 exchange01.domain.local Microsoft ESMTP MAIL Service ready at Mon, 25 Jan 2016 15:37:46 -0600",

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,3,10.0.1.19:25,x.x.x.x:60062,<,EHLO Zixserver,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,4,10.0.1.19:25,x.x.x.x:60062,>,250-exchange01.domain.local Hello [x.x.x.x],

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,5,10.0.1.19:25,x.x.x.x:60062,>,250-SIZE,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,6,10.0.1.19:25,x.x.x.x:60062,>,250-PIPELINING,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,7,10.0.1.19:25,x.x.x.x:60062,>,250-DSN,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,8,10.0.1.19:25,x.x.x.x:60062,>,250-ENHANCEDSTATUSCODES,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,9,10.0.1.19:25,x.x.x.x:60062,>,250-STARTTLS,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,10,10.0.1.19:25,x.x.x.x:60062,>,250-X-ANONYMOUSTLS,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,11,10.0.1.19:25,x.x.x.x:60062,>,250-AUTH NTLM,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,12,10.0.1.19:25,x.x.x.x:60062,>,250-X-EXPS GSSAPI NTLM,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,13,10.0.1.19:25,x.x.x.x:60062,>,250-8BITMIME,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,14,10.0.1.19:25,x.x.x.x:60062,>,250-BINARYMIME,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,15,10.0.1.19:25,x.x.x.x:60062,>,250-CHUNKING,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,16,10.0.1.19:25,x.x.x.x:60062,>,250-XEXCH50,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,17,10.0.1.19:25,x.x.x.x:60062,>,250-XRDST,

    2016-01-25T21:37:47.434Z,EXCHANGE01\Default EXCHANGE01,address,18,10.0.1.19:25,x.x.x.x:60062,>,250 XSHADOW,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,19,10.0.1.19:25,x.x.x.x:60062,<,STARTTLS,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,20,10.0.1.19:25,x.x.x.x:60062,>,220 2.0.0 SMTP server ready,

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,21,10.0.1.19:25,x.x.x.x:60062,*,,Sending certificate

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,22,10.0.1.19:25,x.x.x.x:60062,*,CN=exchange01,Certificate subject

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,23,10.0.1.19:25,x.x.x.x:60062,*,CN=exchange01,Certificate issuer name

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,24,10.0.1.19:25,x.x.x.x:60062,*,****,Certificate serial number

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,25,10.0.1.19:25,x.x.x.x:60062,*,****,Certificate thumbprint

    2016-01-25T21:37:47.465Z,EXCHANGE01\Default EXCHANGE01,address,26,10.0.1.19:25,x.x.x.x:60062,*,exchange01;exchange01.domain.local,Certificate alternate names

    2016-01-25T21:37:47.543Z,EXCHANGE01\Default EXCHANGE01,address,27,10.0.1.19:25,x.x.x.x:60062,*,,"TLS protocol SP_PROT_TLS1_0_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_128 with strength 128 bits, MAC hash algorithm CALG_SHA1 with strength 160 bits and key exchange algorithm CALG_RSA_KEYX with strength 2048 bits"

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,28,10.0.1.19:25,x.x.x.x:60062,<,EHLO server,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,29,10.0.1.19:25,x.x.x.x:60062,*,,TlsDomainCapabilities='None'; Status='NoRemoteCertificate'

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,30,10.0.1.19:25,x.x.x.x:60062,>,250-exchange01.domain.local Hello [x.x.x.x],

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,31,10.0.1.19:25,x.x.x.x:60062,>,250-SIZE,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,32,10.0.1.19:25,x.x.x.x:60062,>,250-PIPELINING,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,33,10.0.1.19:25,x.x.x.x:60062,>,250-DSN,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,34,10.0.1.19:25,x.x.x.x:60062,>,250-ENHANCEDSTATUSCODES,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,35,10.0.1.19:25,x.x.x.x:60062,>,250-AUTH NTLM LOGIN,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,36,10.0.1.19:25,x.x.x.x:60062,>,250-X-EXPS GSSAPI NTLM,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,37,10.0.1.19:25,x.x.x.x:60062,>,250-8BITMIME,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,38,10.0.1.19:25,x.x.x.x:60062,>,250-BINARYMIME,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,39,10.0.1.19:25,x.x.x.x:60062,>,250-CHUNKING,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,40,10.0.1.19:25,x.x.x.x:60062,>,250-XEXCH50,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,41,10.0.1.19:25,x.x.x.x:60062,>,250-XRDST,

    2016-01-25T21:37:47.574Z,EXCHANGE01\Default EXCHANGE01,address,42,10.0.1.19:25,x.x.x.x:60062,>,250 XSHADOW,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,43,10.0.1.19:25,x.x.x.x:60062,<,MAIL FROM:<****> SIZE=278779,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,44,10.0.1.19:25,x.x.x.x:60062,*,address;2016-01-25T21:37:47.387Z;1,receiving message

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,45,10.0.1.19:25,x.x.x.x:60062,<,RCPT TO:<recipient@domain.net> ORCPT=rfc822;*****@*****,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,46,10.0.1.19:25,x.x.x.x:60062,<,DATA,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,47,10.0.1.19:25,x.x.x.x:60062,>,250 2.1.0 Sender OK,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,48,10.0.1.19:25,x.x.x.x:60062,>,250 2.1.5 Recipient OK,

    2016-01-25T21:37:47.605Z,EXCHANGE01\Default EXCHANGE01,address,49,10.0.1.19:25,x.x.x.x:60062,>,354 Start mail input; end with <CRLF>.<CRLF>,

    2016-01-25T21:37:47.683Z,EXCHANGE01\Default EXCHANGE01,address,50,10.0.1.19:25,x.x.x.x:60062,-,,Remote


    Wednesday, January 27, 2016 10:42 PM
  • Hi,

    Please can you provide the message headers (from Outlook). Also, check the Front End Transport Service receive connector logs which can be found here: C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:    Twitter:   

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Thursday, January 28, 2016 3:15 PM
  • All attachments over 100kb

    NDR:

    Generating server: zixvpm01.SenderDom
    receipient@ourDom
    #< #4.4.2 X-Proprietary; lost connection with mail.ourDom[x.x.x.x] while sending message body> #SMTP#
    Original message headers:
    Return-Path: <sender@SenderDom>
    Received: from 127.0.0.1 (ZixVPM [127.0.0.1])
            by Outbound.SenderDom (Proprietary) with SMTP id 9677F5C49EB
            for <receipient@ourDom>; Tue, 26 Jan 2016 01:06:05 -0600 (CST)
    Received: from Senderforestdom.org (unknown [10.8.3.3])
            (using TLSv1 with cipher AES128-SHA (128/128 bits))
            (No client certificate requested)
            by zixvpm01.SenderDom (Proprietary) with ESMTPS id 47DB45C4948
            for <receipient@ourDom>; Tue, 26 Jan 2016 01:06:02 -0600 (CST)
    Received: from Senderforest.org ([fe80::151d:89d:49b6:a0ab]) by
     Senderforestdom.org ([fe80::9840:65e3:a657:ff93%13]) with mapi id
     14.03.0235.001; Tue, 26 Jan 2016 01:26:38 -0600
    From: "sender" <sender@SenderDom>
    To: "receipient@ourDom" <receipient@ourDom>
    Subject: last
    Thread-Topic: last
    Thread-Index: AdFYCt2A8MdHQOaBTAuhWdxkQWT4jg==
    Date: Tue, 26 Jan 2016 07:26:36 +0000
    Message-ID: <6E543A3EF15AAC4A9397F3A95E8B80E4ADADD92E@UNMCEX2.senderforest.org>
    Accept-Language: en-US
    Content-Language: en-US
    X-MS-Has-Attach: yes
    X-MS-TNEF-Correlator:
    x-originating-ip: [10.8.64.15]
    Content-Type: text/plain
    MIME-Version: 1.0
    X-VPM-MSG-ID: a6481fa3-d9f4-44e4-bfc1-556200690029
    X-VPM-HOST: zixvpm01.SenderDom
    X-VPM-GROUP-ID: 12b90436-ada7-414d-9cde-22d34b3a5aec
    X-VPM-ENC-REGIME: ZixVPM,Plaintext
    X-VPM-CERT-FLAG: 0
    X-VPM-IS-HYBRID: 0

    Thursday, January 28, 2016 4:28 PM
  • Received: from sendersvr (x.x.x.x) by

     exchange01.ourdomain.local (10.0.1.19) with Microsoft SMTP Server (TLS)

     id 14.3.235.1; Tue, 26 Jan 2016 08:32:03 -0600

    Received: from 127.0.0.1 (ZixVPM [127.0.0.1])    by Outbound.senderdom

     (Proprietary) with SMTP id B13C55C49D0             for

     <recipient@ourdomain.net>; Mon, 25 Jan 2016 23:23:55 -0600 (CST)

    Received: fromsenderEX3.senderdom.org (unknown [10.8.3.3])               (using TLSv1

     with cipher AES128-SHA (128/128 bits))                (No client certificate requested)               by

     sendersvr (Proprietary) with ESMTPS id 7B1D65C49CD  for

     <recipient@ourdomain.net>; Mon, 25 Jan 2016 23:23:52 -0600 (CST)

    Received: fromsenderEX2.senderdom.org ([fe80::151d:89d:49b6:a0ab]) by

    senderEX3.senderdom.org ([fe80::9840:65e3:a657:ff93%13]) with mapi id

     14.03.0235.001; Mon, 25 Jan 2016 23:44:28 -0600

    From: "Sender" <sender>

    To: "recipient@ourdomain.net" <recipient@ourdomain.net>

    Subject: h

    Thread-Topic: h

    Thread-Index: AdFX/JYQLJ4kbDjSSPmf48OQsofxgw==

    Date: Tue, 26 Jan 2016 05:44:27 +0000

    Message-ID: <6E543A3EF15AAC4A9397F3A95E8B80E4ADADD8BF@domain.org>

    Accept-Language: en-US

    Content-Language: en-US

    X-MS-Has-Attach: yes

    X-MS-TNEF-Correlator:

    x-originating-ip: [*.*.*.*]

    Content-Type: multipart/mixed;

                    boundary="_004_6E543A3EF15AAC4A9397******_"

    MIME-Version: 1.0

    X-VPM-MSG-ID: 85de291a-c373-41f5-bd5c-8f07e16d29b3

    X-VPM-HOST: sendersvr

    X-VPM-GROUP-ID: e4f94c32-dd26-4aec-9103-5c3639efc13a

    X-VPM-ENC-REGIME: ZixVPM,Plaintext

    X-VPM-CERT-FLAG: 0

    X-VPM-IS-HYBRID: 0

    Return-Path: sender

    X-MS-Exchange-Organization-AuthSource: exchange01.ourdomain.local

    X-MS-Exchange-Organization-AuthAs: Anonymous

    Thursday, January 28, 2016 4:32 PM