none
Inconsistant undeliverable messages

    Question

  • I'm running into a really strange one. We have Exchange 2013, single server deployment, on the inside and a Cisco Ironport C170 on the outside. I have all message size limits set to 40MB, for both Exchange and Ironport. If I try to send a 17MB file to my external account, the first attempt is blocked with the "This message wasn't delivered to anyone because it's too large. The limit is xx MB. This message is xx MB."  However, if I send the email again (either create a completely new email with the same attachement or FW the original), it will go through just fine. 

    When the email is sent the first time and rejected, there is no record of it being blocked by the Ironport, let alone even making it to the Ironport.  The message tracking log in Exchange shows it going through the normal steps before it hits the "FAIL" event. The recipient status data is:

    {[{LRT=};{LED=550 5.3.4 SMTPSEND.OverAdvertisedSize; message size exceeds fixed maximum size};{FQDN=};{IP=}]}

    Right now, our work around is to send any emails with large attachments twice, but I would like to figure out what is going on.  I have rebooted the Exchange server, which didn't make a different, and look through the event logs.  Nothing stood out, but I could have missed something. 

    I am open to thoughts on this one.  Thanks.

    Chris

    Wednesday, September 27, 2017 3:11 PM

All replies

  • Why did you replace the numbers with xx?  Specifics are important in these kinds of questions.

    There are several places where message size limits are enforced, the mailbox, send and connectors, the organization, plus hidden limits in OWA, Outlook Anywhere and Exchange Web Services.  You might want to some specific testing and auditing.

    https://technet.microsoft.com/en-us/library/bb124345(v=exchg.150).aspx


    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Wednesday, September 27, 2017 9:31 PM
    Moderator
  • Hi,

    Thanks for contacting our forum.

    Does this issue only affect external messages? What’s about internal user sending to internal user?

    Could you please post out the detailed message tracking log for one message?

    Does this issue affect all of the users or some of users in one specific DB?

    Thanks for your effort.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, September 28, 2017 6:07 AM
    Moderator
  • Thanks Ed.  Sorry for taking out the numbers. The first set of xx is 15MB, but the second set changes depending on the size of the email being sent.  I haven't been able to find any limits that are set to 15MB.

    I have gone through the various message size limits and confirmed all pertinent limits are set appropriately.  Below are the sizes listed.

    [PS] C:\Windows\system32>Get-TransportConfig | fl *size*

    MaxDumpsterSizePerDatabase      : 18 MB (18,874,368 bytes)
    MaxReceiveSize                  : 40 MB (41,943,040 bytes)
    MaxSendSize                     : 40 MB (41,943,040 bytes)
    ExternalDsnMaxMessageAttachSize : 10 MB (10,485,760 bytes)
    InternalDsnMaxMessageAttachSize : 10 MB (10,485,760 bytes)
    TransportRuleSizeLimit          : 4 KB (4,096 bytes)

    [PS] C:\Windows\system32>Get-SendConnector -Identity <sendconnector> | fl *size*

    MaxMessageSize : 40 MB (41,943,040 bytes)

    [PS] C:\Windows\system32>get-mailbox <user> | fl *size*

    MaxSendSize    : 39.06 MB (40,960,000 bytes)
    MaxReceiveSize : 39.06 MB (40,960,000 bytes)

    Thursday, September 28, 2017 2:10 PM
  • Hi Jason,

    The issue only seems to be affected messages going external to the organization.  Internally, the messages send fine.  The database has a lot of users, but not all of them are allowed to send larger emails. I know that this is happening with myself and one other user, but have not checked with any one else.

    Here is a customized message tracking log for a single test message performed yesterday.  I would rather not post a full detail of each step due to all of the internal information, so if there is something additional you need, let me know and I will get it to you.

    Timestamp                   EventId                Source             MessageSubject  TotalBytes
    ---------                        -------                 ------               --------------        ----------
    9/27/2017 9:41:56 AM  RECEIVE              STOREDRIVER  FW: test email     20258898
    9/27/2017 9:41:56 AM  HAREDIRECTFAIL SMTP               FW: test email     20259566
    9/27/2017 9:41:57 AM  RECEIVE              SMTP               FW: test email     20259566
    9/27/2017 9:41:57 AM  SUBMIT               STOREDRIVER  FW: test email
    9/27/2017 9:41:59 AM  AGENTINFO         AGENT             FW: test email     20260626
    9/27/2017 9:41:59 AM  TRANSFER           ROUTING         FW: test email     27708551
    9/27/2017 9:42:01 AM  FAIL                    SMTP              FW: test email      27708889

    Thanks again for your help.

    Thursday, September 28, 2017 2:29 PM
  • Thanks for your information.

    I want to know the detailed message of "9/27/2017 9:41:59 AM  AGENTINFO  AGENT    FW: test email 20260626" and the last hop "fail" in the message tracking log.

    It’s recommended to check if you’ve created some transport rules with the size limitation for the problematic users and I think the rules could be corrupted.

    Hope it helps.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, September 29, 2017 1:54 AM
    Moderator
  • You're doing this with Outlook, and not OWA, Exchange Web Services (e.g. Mac Outlook) or ActiveSync, correct?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Friday, September 29, 2017 4:34 AM
    Moderator
  • Below are the logs that you are requesting. I do currently have two rules in place that control size of emails. One that will block all email over 10MB (not the 15MB from the bounceback) except if they are a member of a specific group. Another that will block email over 30MB (applies to the people that are members of the specific group mentioned above). I have looked through the rules and they appear to be correct.

    PSComputerName            <exchange server>
    RunspaceId                e2bc507c-0528-4576-9969-8320a1a7175c
    PSShowComputerName        False
    Timestamp                 9/27/2017 9 41 59 AM
    ClientIp                
    ClientHostname            <exchange server>
    ServerIp                
    ServerHostname          
    SourceContext           
    ConnectorId             
    Source                    AGENT
    EventId                   AGENTINFO
    InternalMessageId         96658238997231
    MessageId                 <<exchange server>>
    Recipients                {external email address}
    RecipientStatus           {}
    TotalBytes                20260626
    RecipientCount            1
    RelatedRecipientAddress 
    Reference               
    MessageSubject            FW  test email
    Sender                    <internal email address>
    ReturnPath                <internal email address>
    Directionality            Originating
    TenantId                
    OriginalClientIp          <my internal IP address>
    MessageInfo             
    MessageLatency          
    MessageLatencyType        None
    EventData                 {[AMA, SUM|v=0|action=|error=|atch=1], [AMA, EV|engine=M|v=0|sig=1.251.1495.0|name=|file=], [CompCost,
                              |AMA=0|ETR=0], [DeliveryPriority, Low], [PrioritizationReason, AMS 20259716/1048576|ARC 2/500;2000],
                              [AccountForest, xxx.xxxxxxxx.xxx]}


    PSComputerName            <exchange server>
    RunspaceId                e2bc507c-0528-4576-9969-8320a1a7175c
    PSShowComputerName        False
    Timestamp                 9/27/2017 9 42 01 AM
    ClientIp                  <server IP address>
    ClientHostname            <exchange server>
    ServerIp                  <external address>
    ServerHostname            <external address>
    SourceContext           
    ConnectorId               Exch2013OutboundIronPort
    Source                    SMTP
    EventId                   FAIL
    InternalMessageId         96658238997235
    MessageId                 <exchange server>>
    Recipients                {external email address}
    RecipientStatus           {[{LRT=};{LED=550 5.3.4 SMTPSEND.OverAdvertisedSize; message size exceeds fixed maximum size};{FQDN=};{IP=}]}
    TotalBytes                27708889
    RecipientCount            1
    RelatedRecipientAddress 
    Reference                 {<<exchange server>>}
    MessageSubject            FW  test email
    Sender                    <internal email address>
    ReturnPath                <internal email address>
    Directionality            Originating
    TenantId                
    OriginalClientIp        
    MessageInfo               2017-09-27T14 41 55.841Z;SRV=<exchange server> TOTAL-SUB=0.546|SA=0.046|MTSSDA=0.004|MTSSDC=0.367|MTSSD
                              MO=0.015;MTSS|MTSSD;SRV=<exchange server> TOTAL-HUB=4.859|SMRDI=0.328|SMRCL=0.229|SMRC=0.229|SMR=0.558|
                              CATSM-RMS Decryption Agent=0.141|CATSM-Malware Agent=0.090|CATSM-RMS Encryption
                              Agent=0.136|CATSM=0.368|CATRS-Prioritization Agent=0.138|CATRS-Transport Rule Agent=0.280|CATRS-Index Routing
                              Agent=0.954|CATRS=1.372|CATRT-RMS Encryption
                              Agent=0.136|CATRT=0.137|CCC=0.736|CATCM-McAfeeTxRoutingAgent=0.597|CATCM=0.597|CAT=3.215|SMSC=0.578
    MessageLatency          
    MessageLatencyType        None
    EventData                 {[E2ELatency, 5.406], [ExternalSendLatency, 4.750],
                              [Microsoft.Exchange.Transport.MailRecipient.RequiredTlsAuthLevel, Opportunistic],
                              [Microsoft.Exchange.Transport.MailRecipient.EffectiveTlsAuthLevel, EncryptionOnly], [DeliveryPriority, Low],
                              [PrioritizationReason, AMS 20259716/1048576|ARC 2/500;2000], [AccountForest, xxxx.xxxxxxx.xxx]}

    Friday, September 29, 2017 1:36 PM
  • I have tried both Outlook and OWA, but receive the same error.
    Friday, September 29, 2017 1:37 PM
  • See this article for some additional changes you may need to make. 

    https://technet.microsoft.com/en-us/library/hh529949(v=exchg.160).aspx

    As far as I know, they don't affect Outlook unless you have some unusual configuration, so if you're really having problems with Outlook, it could be somewhere else.


    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!


    Friday, September 29, 2017 3:40 PM
    Moderator
  • Thanks for the link.  I checked everything that pertains to the issue (and then some), but nothing appeared to need changing.  I don't think our configuration is that unusually, at least it seems pretty straight forward to me.  I have no idea where this 15MB limit is coming from.
    Tuesday, October 3, 2017 1:56 PM
  • Thanks for your response.

    The logs seems fine. Do you have any device between your exchange server and the internet? any limitation on it?

    Thanks.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, October 6, 2017 8:35 AM
    Moderator
  • Thanks for getting back to me. Just our Ironport. I've also gone through that one and confirmed there is nothing with a 15MB limit. I can also look at the logs on that device and see when an email passes through, but the emails that get blocked due to size never show up. That would indicate that the emails are not actually making it to the Ironport.
    Friday, October 6, 2017 3:00 PM
  • Please check if you have this issue when send to everyone or specific one.

    It’s recommended to check if the specific users(recopients) have the corrupted and hidden rule as below if it's a outlook user:

    https://blogs.msdn.microsoft.com/hkong/2015/02/27/how-to-delete-corrupted-hidden-inbox-rules-from-a-mailbox-using-mfcmapi/

    The rule settings.


    Regards,

    Jason Chao


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 16, 2017 2:25 AM
    Moderator