none
Messages disappearing from postmaster

    Question

  • We currently have an Exchange 2013 server that hosts all roles for mail in our environment. In front of it we use a product called Modusgate to do our spam/virus filtering. 

    Lately (at least the last week), the quarantine report that gets generated by modusgate hasn't made it to the users mailbox. If i go into their software and manually generate it , it comes through no issue. I figured it was an issue with them so i overrode the settings and had it send me the report at the same time as the original user. However the next day when i should have gotten it, i couldn't find it and the user didn't get it either. I manually kicked it off and recieved it right away. 

    So here is the odd part I'm struggling with. The support on the spam filter was able to see in the logs where the message that was scheduled was said to be handed off to our mail server. However if i use the EAC and do delivery reports, any message from postmaster doesn't show up at all so i can't tell where these messages went. 

    I've checked both the junk mail/quarantine folders in Outlook just in case but no where to be found. I would still think it would show up as delivered in the EAC report. 

    Any ideas ? 



    Friday, October 28, 2016 8:33 PM

Answers

  • We currently have an Exchange 2013 server that hosts all roles for mail in our environment. In front of it we use a product called Modusgate to do our spam/virus filtering. 

    Lately (at least the last week), the quarantine report that gets generated by modusgate hasn't made it to the users mailbox. If i go into their software and manually generate it , it comes through no issue. I figured it was an issue with them so i overrode the settings and had it send me the report at the same time as the original user. However the next day when i should have gotten it, i couldn't find it and the user didn't get it either. I manually kicked it off and recieved it right away. 

    So here is the odd part I'm struggling with. The support on the spam filter was able to see in the logs where the message that was scheduled was said to be handed off to our mail server. However if i use the EAC and do delivery reports, any message from postmaster doesn't show up at all so i can't tell where these messages went. 

    I've checked both the junk mail/quarantine folders in Outlook just in case but no where to be found. I would still think it would show up as delivered in the EAC report. 

    Any ideas ? 



    Enable protocol logging on the receive connector that handles the messages from the ModusGate thingy

    and see what is happening during the SMTP conversation from the Exchange side.

    https://technet.microsoft.com/en-us/library/bb124531(v=exchg.150).aspx


    Blog:    Twitter:   


    Friday, October 28, 2016 8:46 PM
  • Thanks, I'm guessing turning that on will apply for all messages as our mail flow is all external email hits the filter and then has a route connection in modusgate to drop it to our exchange if a mailbox exists for the user. I'm trying to avoid having it on for long since I wasn't sure what kind of overhead it added.  I see 5 different receive connectors in our setup (Client Frontend, Client Proxy, Default Frontend, Default Proxy, and outbound Proxy frontend.) I'm guessing it would the Client FrontEnd that i would have to turn on. 

    It doesn't appear any services need restarted or anything, is that correct ? 

    I'm still curious as well why i can't search for postmaster messages in the EAC for myself or the other user though i know some have gotten delivered. 


    Hi,

    In EAC, the delivery reports tracks messages sent by people using the Microsoft Outlook or Outlook Web App email clients. So that's why we can't search such messages in EAC. And you may consider to do message tracking rather than search delivery reports.

    https://technet.microsoft.com/en-us/library/aa997984(v=exchg.150).aspx

    https://technet.microsoft.com/en-us/library/bb124926(v=exchg.150).aspx

    After you enable protocol logging for Client FrontEnd connectors, have you found anything in those logs?


    Regards,

    Lynn-Li

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 2, 2016 2:21 AM
    Moderator

All replies

  • We currently have an Exchange 2013 server that hosts all roles for mail in our environment. In front of it we use a product called Modusgate to do our spam/virus filtering. 

    Lately (at least the last week), the quarantine report that gets generated by modusgate hasn't made it to the users mailbox. If i go into their software and manually generate it , it comes through no issue. I figured it was an issue with them so i overrode the settings and had it send me the report at the same time as the original user. However the next day when i should have gotten it, i couldn't find it and the user didn't get it either. I manually kicked it off and recieved it right away. 

    So here is the odd part I'm struggling with. The support on the spam filter was able to see in the logs where the message that was scheduled was said to be handed off to our mail server. However if i use the EAC and do delivery reports, any message from postmaster doesn't show up at all so i can't tell where these messages went. 

    I've checked both the junk mail/quarantine folders in Outlook just in case but no where to be found. I would still think it would show up as delivered in the EAC report. 

    Any ideas ? 



    Enable protocol logging on the receive connector that handles the messages from the ModusGate thingy

    and see what is happening during the SMTP conversation from the Exchange side.

    https://technet.microsoft.com/en-us/library/bb124531(v=exchg.150).aspx


    Blog:    Twitter:   


    Friday, October 28, 2016 8:46 PM
  • Thanks, I'm guessing turning that on will apply for all messages as our mail flow is all external email hits the filter and then has a route connection in modusgate to drop it to our exchange if a mailbox exists for the user. I'm trying to avoid having it on for long since I wasn't sure what kind of overhead it added.  I see 5 different receive connectors in our setup (Client Frontend, Client Proxy, Default Frontend, Default Proxy, and outbound Proxy frontend.) I'm guessing it would the Client FrontEnd that i would have to turn on. 

    It doesn't appear any services need restarted or anything, is that correct ? 

    I'm still curious as well why i can't search for postmaster messages in the EAC for myself or the other user though i know some have gotten delivered. 


    Friday, October 28, 2016 9:00 PM
  • Thanks, I'm guessing turning that on will apply for all messages as our mail flow is all external email hits the filter and then has a route connection in modusgate to drop it to our exchange if a mailbox exists for the user. I'm trying to avoid having it on for long since I wasn't sure what kind of overhead it added.  I see 5 different receive connectors in our setup (Client Frontend, Client Proxy, Default Frontend, Default Proxy, and outbound Proxy frontend.) I'm guessing it would the Client FrontEnd that i would have to turn on. 

    It doesn't appear any services need restarted or anything, is that correct ? 

    I'm still curious as well why i can't search for postmaster messages in the EAC for myself or the other user though i know some have gotten delivered. 


    Well, I don't use EAC, only powershell for message tracking searches, so maybe try that.

    The perf hit shouldn't be too bad. The default frontend is the one you want unless you have a custom receive connector for just inbound mail from the internet. You may need to restart the transport service.


    Blog:    Twitter:   


    Friday, October 28, 2016 10:21 PM
  • Thanks, I'm guessing turning that on will apply for all messages as our mail flow is all external email hits the filter and then has a route connection in modusgate to drop it to our exchange if a mailbox exists for the user. I'm trying to avoid having it on for long since I wasn't sure what kind of overhead it added.  I see 5 different receive connectors in our setup (Client Frontend, Client Proxy, Default Frontend, Default Proxy, and outbound Proxy frontend.) I'm guessing it would the Client FrontEnd that i would have to turn on. 

    It doesn't appear any services need restarted or anything, is that correct ? 

    I'm still curious as well why i can't search for postmaster messages in the EAC for myself or the other user though i know some have gotten delivered. 


    Hi,

    In EAC, the delivery reports tracks messages sent by people using the Microsoft Outlook or Outlook Web App email clients. So that's why we can't search such messages in EAC. And you may consider to do message tracking rather than search delivery reports.

    https://technet.microsoft.com/en-us/library/aa997984(v=exchg.150).aspx

    https://technet.microsoft.com/en-us/library/bb124926(v=exchg.150).aspx

    After you enable protocol logging for Client FrontEnd connectors, have you found anything in those logs?


    Regards,

    Lynn-Li

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 2, 2016 2:21 AM
    Moderator