Exchange Diagnosing Mail Delivery Latency

From time to time we get reports of incoming message delivery and mail flow slowness. Usually this occurs when one of our anonymous systems sends a relay email blast and clogs up the works.

There are two online tools that I use in order to find where the latency occurs; by analyzing the mail headers.

One is the Exchange Remote Connectivity Analyzer (ExRCA) the other is MXToolbox.

First you'll need to grab the mail header.

You can either use Outlook or your spam appliance. I usually use our spam filter (which will usually cache those messages for several days) and if the message wasn't delivered to a mailbox, you can't get the header from Outlook :)

To use Outlook, open the message, go to File > Properties.

At the bottom of the window, in the Internet headers section, copy the entire block of text:

 

 

To use your spam filter, for instance on a Barracuda, go to Basic > Message Log. Search for the message and open it. Under View Source, copy the entire text block.

 



Once you have your message header, you can now use an analyzer to find the latency problems.

ExRCA:

Go to https://testconnectivity.microsoft.com/ or exrca.com (if you're oldschool) and click on the Message Analyzer tab:

 

Paste the header text that you copied earlier into the box and hit the Analyze Headers button.

 

It will generate a report of hops the message took and where the message sat and for how long:

 



As you can see, the message sat on the Edge Server and a Mailbox Server totaling 3 seconds. Most of the time when we see delivery lags, its on the spam filter - cuda-1 in our case. This is usually because it's being hammered by something like email blasts and can't catch up to the queue.

MXToolbox:

To use MXToolbox, go to http://mxtoolbox.com/EmailHeaders.aspx and paste your header text into the box, then hit Analyzer Header.

You'll get a report similar to the ExRCA summary, but with a little bit different info:

And the same here, it took 3 seconds to deliver the message. MXToolbox will also tell you if the sender is blacklisted as well, which is nice.

Now, you've found where the latency occurs, go fix it!