External companies with Barracuda firewalls not able to deliver mail to our Exchange 2013 environment reliably.

Question

We upgraded to Exchange 2013 about a year ago. Since that time we've been having issues with certain companies having their mail delayed or rejected when sending to us. No problems us sending to them though.  Eventually through troubleshooting I have
determined that all of these different companies have one thing in common: a barracuda firewall.
In the year since the installation I have updated Exchange all the way to SP1 but we still have this issue. The messages usually arrive to us, but quite often a day later, etc.  Here is the message from one from the 26th that was rejected:
#< #4.0.0 X-Spam-&-Virus-Firewall; conversation with
mail.domain.ca[64.46.58.226] timed out while sending MAIL FROM> #SMTP#
Original message headers:
X-ASG-Debug-ID: 1406427098-0499ef4412c2d00001-3TTufb
Received: from DEVPMTLEXC2.devp.org ([192.168.1.202]) by
barracuda.devp.org
 with ESMTP id EiJxT4ex1jxAnxdL; Sat, 26 Jul 2014 22:11:38 -0400 (EDT)
X-Barracuda-Envelope-From: [email protected]
X-ASG-Whitelist: Client
Received: from DEVPMTLEXC2.devp.org ([192.168.1.202]) by
DEVPMTLEXC2.devp.org
 ([192.168.1.202]) with mapi id 14.03.0195.001; Sat, 26 Jul 2014 22:11:37
 -0400
From: "Farid, Sara" <[email protected]>
To: >
Subject:
X-ASG-Orig-Subj:
Thread-Index: AQHPqUAYJnlCbEpneUasDGYYczT9uw==
Date: Sun, 27 Jul 2014 02:11:37 +0000
Message-ID: <[email protected]>
References: <[email protected]>,<[email protected]>,<[email protected]>
In-Reply-To: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Content-Type: multipart/mixed;
            boundary="_015_7FA4F0153A8D4D739357AED074A05ECFdevporg_"
MIME-Version: 1.0
X-Barracuda-Connect: UNKNOWN[192.168.1.202]
X-Barracuda-Start-Time: 1406427098
X-Barracuda-URL: http://172.16.1.200:8000/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at devp.org
X-Barracuda-BRTS-Status: 1
Our Environment:
2x Exchange 2013 Std. SP1 Servers, All roles, DAG. We only use the built-in Exchange tools for anti-spam, traffic flows to and from exchange directly through NAT.

Answer 1

Hi, yesterday we had a very large outbound queue on our Barracuda's.
I did some investigation and found that all remote servers are Exchange servers. After some telnet smtp tests they all had the same problem. After sending the RCPT TO: command it takes between the 60 and 120 seconds to get the Recipient OK response. While
other servers answer in a second.
Before I contacted Barracuda I found your article.
I contacted Barracuda about this and they said it's a problem of the remote exchange servers which won't respond within the accepted time and not a Barracuda issue. The barracuda disconnects after 60 seconds and the official RFC describes that
the whole process should only take a few seconds.
They said that I could be that the remote server is doeing a spam or RBL lookup which cannot be done and causes too much delay. And because of this timeout the SMTP process takes much too time and the barracuda will disconnect before the
exchange server responds OK.
The outgoing timeout in the barracuda can't be changed manually and it should be fixed at the recipients side but the Barracuda support did make a change deep level in the config so our time out has been set to 120 seconds now and works for us but this only
works until we apply new firmware.
I suggest that you do some Telnet tests with your exchange if you could find if and why the RCPT TO: hangs for such a long time to respond. Please let me know if you'll find something so I can inform the remote companies which affects this.
Regards
Gert