Emails Delayed between hops.

Is this a new implementation? How long has the ERP system been sending emails through Central to your internal domain? I ask because Sophos does have a Delay Queue for new streams of mail that starts coming to clients and this generally clears up in the first 24-48 hours of receiving messages.

Afternoon Tom - The ERP system has been in our company for 20 years, and when we first implemented Sophos, emails were already part of the mail flow.  That's nice to know about the Delay Queue, but I think maybe unrelated to this current issue.  I work with an MSP, and they just updated our mallow rule connects to the new Certificate Based configuration.  I'm still getting user reports telling me it takes anywhere to 3-8 minutes when they request a document through the ERP to be sent via email, until it's delivered to their inbox. Feels like trying to find a needle..

Send me a direct email tom[.]foucha[@]sophos[.]com with your domain name and some message headers that I can have someone look into our backend logs. Certificate Based only applies to outbound messages from the domain not inbound. Obviously i can't troubleshoot the ERP SMTP system from time of request but I can look into when we received the message to when we deliver it. One thing I would ask you to inspect is the placement of CodeTwo, that creates loops if not in the correct place in mail rules. Is CodeTwo required for internal emails?

https://www.codetwo.com/userguide/email-signatures-for-office-365/smart-hosts.htm

 If you use a smart host service (such as Barracuda, Proofpoint, Reflexion or Mimecast) for security, archiving or anti-spam protection in your organization, you can integrate it with CodeTwo Email Signatures 365. All you need to do is configure your mail flow so that messages are routed through CodeTwo cloud services (located in Microsoft Azure datacenters) before they reach your smart host.

https://www.codetwo.com/userguide/email-signatures-for-office-365/smart-hosts.htm

 If you use a smart host service (such as Barracuda, Proofpoint, Reflexion or Mimecast) for security, archiving or anti-spam protection in your organization, you can integrate it with CodeTwo Email Signatures 365. All you need to do is configure your mail flow so that messages are routed through CodeTwo cloud services (located in Microsoft Azure datacenters) before they reach your smart host.

Tom - will send you a direct email and some message headers here shortly.  As for CodeTwo - we use Sophos with our MS365 only - so not sure if this qualifies as a smart host service besides what would be normal.  Our Code Two Cloud Service gets auto configured during their connection process so I'm assuming that is configured how they wanted (Through he CodeTwo Admin Console its doe the connection with MS365 and builds the mail flow connection and rules)