Why did this message take so long to arrive?

Received: headers are a great place to start to figure out why a message was delayed.  Only the computer that delayed it will have logs and information about the cause of the delay, but Received: headers can help you pinpoint which computer it is.

Let's look at an example, that took about 2 minutes and 20 seconds to deliver:

    1. Received:     by lab.pobox.com (Postfix, from userid 1004) id 820C52E7B3; Mon, 13 Jun 2011 08:15:57 -0400 (EDT)
    2. Received:     from a-icg-mx-sd.icgroup.com (a-icg-mx-sd.icgroup.com []) by lab.pobox.com (Postfix) with ESMTP id 8D5212E7B1 for <address>; Mon, 13 Jun 2011 08:15:56 -0400 (EDT)
    3. Received:     by a-icg-mx-sd.icgroup.com (Postfix) id 90A38381F; Mon, 13 Jun 2011 08:15:53 -0400 (EDT)
    4. Received:     from ironport01.ktbenefits.com (ironport.ktbenefits.com []) by a-icg-mx-sd.icgroup.com (Postfix) with ESMTP id 71E34381E for <address>; Mon, 13 Jun 2011 08:15:53 -0400 (EDT)
    5. Received:     from unknown (HELO mail.ktbenefits.com) ([]) by ironport01.ktbenefits.com with ESMTP; 13 Jun 2011 08:13:42 -0400
    6. Received:     from ktb-berwyn02.ktb.local ([]) by mail.ktbenefits.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 13 Jun 2011 08:13:42 -0400

Looking at the headers, the big delay is between 4 and 5 -- from 08:13:42 to 08:15:53, or the entire 2 minutes.  Once the message is handed off to icgroup.com, the rest of the delivery takes about 4 seconds.  So, if we were concerned about why this message took 2 minutes, we would have to contact ktbenefits.com, to have their administrator check the mail logs for the reason.  (Of course, keep in mind that for anything under 5 minutes, the "reason" is likely to be "sometimes it just takes a couple of minutes."  Most delays under 10 or 15 minutes do not have a logged cause.)

When reviewing Received: headers, don't forget that timestamps show the local time of the computer that handled it, not your local time.  So, if a message goes from the East Coast to the West Coast, or vice versa, you'll see a 3 hour difference in the logs. 

Was this article helpful?
0 out of 1 found this helpful