I may be a day late and dollar short but I just recently ran into this and alas, your question came up. My turned out to be bad DNS resolution as a result of MalwareBytes.
I could see the e-mails hanging out in the IIS SMTP queue and eventually it would fail. Here is some things I did and ultimately figured out the cause.
For us, it was specifically to one domain.
I ran packet capturing on our firewall to see if I could see the traffic going out of the e-mail server. It was not so I knew the packets were stopping within the network. I also did not see any blocking messages in the firewall logs specifically blocking the traffic.
Step 1: Go to MXToolbox and plug their domain name in for the MX Lookup Tool. This will give you the correct IP address you'll verify in step 2.
You should also put your public IP address in there and run the blacklist check and SPF check.
Step 2: Run
NSLOOKUP from the command prompt on the SMTP server.
>>nslookup -type=mx domain.com
domain.com MX preference = 1, mail exchanger = mail.domain.com
mail.domain.com internet address = 188.8.131.52
This was the issue we had specifically. Our local DNS server was resolving the domain to a 127.x.x.x IP address. That was identified immediately as the problem and we tracked it down to an issue with MalwareBytes not allowing the DNS server to resolve the domain. We had to disable MWB, clear the DNS cache and then query the domain again to get the correct IP.
domain.com MX preference = 10, mail exchanger = mx.domain.com
mx.domain.com internet address = 127.42.0.2
mx.domain.com internet address = 127.42.0.4
mx.domain.com internet address = 127.42.0.5
Step 2: Telnet to the mail exchanger domain on port 25. You should see the following. Try to type
EHLO domain.com if it connects and you should see some more things pop up.
>> telnet mail.domain.com
220 xmail03.domain.com ESMTP 648143d3667b3045487bb901cdbbf649
250-AUTH LOGIN PLAIN
If it does not connect or just gives a black screen, press ENTER. If it dumps you back out to the command prompt it's not connecting or the server is refusing it.