[Exim] Odd problems when sending to specific mail adresses

Hello,

this may be a bit off topic but I'm running out of ideas here...

I'm delivering mail from an Exim 4.14 over a
VPN (IPsec, Checkpoint FW-1 NG my side, FW-1 4.1 other side)
to an NAI WebShield SMTP server behind the VPN.

The problem is now, with _some_ mails, the SMTP delivery
connection hangs after Exim has transmitted the final '.'
waiting for the 250 from the remote WebShield.

I know this sounds very similiar to some MTU problems
in the archives and this is what the mail admins of the
remote server think too, but the funny part is:
Other mails to the same server over the VPN go through
fine - to other recipients, and in some cases even to the
very same recipients as the problematic mails.
Also, if I interpret the tcpdump (see below) corectly,
it seems that PMTUD is working and the remote host is
ACKing the larger data packets as well.

Any ideas?

Thanks in advance,

Florian

---
16:04:47.895626 I 192.168.96.87.52101 > 10.0.6.31.25: S
3770621499:3770621499(0) win 24820 <mss 1460> (DF) (ttl 63, id 43065)
16:04:47.918903 O 10.0.6.31.25 > 192.168.96.87.52101: S
2455920232:2455920232(0) ack 3770621500 win 5840 <mss 1460> (DF) (ttl 62, id
0)
16:04:47.919281 I 192.168.96.87.52101 > 10.0.6.31.25: . ack 1 win 24820 (DF)
(ttl 63, id 43066)
16:04:47.943823 O 10.0.6.31.25 > 192.168.96.87.52101: P 1:54(53) ack 1 win
5840 (DF) (ttl 62, id 57205)
16:04:47.948465 I 192.168.96.87.52101 > 10.0.6.31.25: . ack 54 win 24820
(DF) (ttl 63, id 43067)
16:04:47.950580 I 192.168.96.87.52101 > 10.0.6.31.25: P 1:26(25) ack 54 win
24820 (DF) (ttl 63, id 43068)
16:04:47.974024 O 10.0.6.31.25 > 192.168.96.87.52101: . ack 26 win 5840 (DF)
(ttl 62, id 57206)
16:04:47.974135 O 10.0.6.31.25 > 192.168.96.87.52101: P 54:98(44) ack 26 win
5840 (DF) (ttl 62, id 57207)
16:04:47.975540 I 192.168.96.87.52101 > 10.0.6.31.25: P 26:60(34) ack 98 win
24820 (DF) (ttl 63, id 43069)
16:04:47.999429 O 10.0.6.31.25 > 192.168.96.87.52101: P 98:136(38) ack 60
win 5840 (DF) (ttl 62, id 57208)
16:04:48.006493 I 192.168.96.87.52101 > 10.0.6.31.25: P 60:94(34) ack 136
win 24820 (DF) (ttl 63, id 43070)
16:04:48.028956 O 10.0.6.31.25 > 192.168.96.87.52101: P 136:180(44) ack 94
win 5840 (DF) (ttl 62, id 57209)
16:04:48.029581 I 192.168.96.87.52101 > 10.0.6.31.25: P 94:100(6) ack 180
win 24820 (DF) (ttl 63, id 43071)
16:04:48.052413 O 10.0.6.31.25 > 192.168.96.87.52101: P 180:230(50) ack 100
win 5840 (DF) (ttl 62, id 57210)
16:04:48.054232 I 192.168.96.87.52101 > 10.0.6.31.25: . 100:1560(1460) ack
230 win 24820 (DF) (ttl 63, id 43072)
16:04:48.054646 I 192.168.96.87.52101 > 10.0.6.31.25: P 1560:3020(1460) ack
230 win 24820 (DF) (ttl 63, id 43073)
16:04:48.054651 I 192.168.96.87.52101 > 10.0.6.31.25: . 3020:4480(1460) ack
230 win 24820 (DF) (ttl 63, id 43074)
16:04:48.054655 I 192.168.96.87.52101 > 10.0.6.31.25: P 4480:4598(118) ack
230 win 24820 (DF) (ttl 63, id 43075)
16:04:48.081379 O 10.0.6.31.25 > 192.168.96.87.52101: . ack 1560 win 8760
(DF) (ttl 62, id 57211)
16:04:48.081464 O 10.0.6.31.25 > 192.168.96.87.52101: . ack 4480 win 14600
(DF) (ttl 62, id 57212)
16:04:48.115359 O 10.0.6.31.25 > 192.168.96.87.52101: . ack 4598 win 14600
(DF) (ttl 62, id 57213)
---