Thank you Victor, your detailed analysis of the TCP dump made me look into the right direction.
Virtualisation (KVM) is also used here, but that was not the reason for the behaviour. It also wasnt TCP offloading, although used. The culprit was a firewall. I am a bit limited as to what I can expose of that customers infrastructure, though. I disconnected all the security boxes and saw incoming mails from the outlook.com servers without problems. Then I reconnected boxes one by one and found the troublemaker. Hope this will be of help to somebody, and thanks again to Victor for the helpful analysis. Andreas -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/