Cannot send email to more than 100 BCC recipients

[petepalmer51]

So far we are noticing this issue when a user tries to send an email to more than 100 recipients listed in the BCC: field. Sending the same message to 100 or fewer recipients is successful.

The error received is: #550 4.4.7 QUEUE.Expired; message expired ##

Message tracking shows the message being processed in ESA (C680) every minute or 2 but the subject is stripped "(empty subject)" and the last state on each showing as "Incoming connection (ICID ########) lost. Message ####### aborted: Receiving aborted".

This was not an issue until a few weeks ago. Previously users could send to this number of BCC recipients without issue. The operating system version is 9.6.0-042.

We would like to restore the ability for senders to have more than 100 recipients in the BCC: field.

Has anyone seen this issue and found a resolution?

[Mathew Huynh]

Hello Pete,

From what you have added on the error message received and what you've described on the message tracking.

it looks like the mail transfer is being interrupted and thus causing an issue where the email is failing to leave their exchange server, and ESA is failing to get the entire message data in that one transaction.

I would suggest to troubleshoot this to see why there is an issue of the transfer, open a packet capture on the ESA on port 25.

Replicate this issue, then stop the capture to review it.

Chances are I believe the email is not completely transferred to the ESA (thus the empty subject line) within the 5 minutes of TCP window and connection  is aborted, and delivery from exchange continues to fail and gets bounced eventually.

If the ESA is rejecting it due to the number of recipients, it would send a specific SMTP response to state this, this behaviour is stemming more along the lines of a SMTP/TCP interruption.

Regards,

Matthew

[petepalmer51]

Thanks for the suggestion, Mathew. We have traced to issue to a replacement ASA installed last month coinciding with the start of this issue. The ASA was not properly configured regarding "inspect esmtp".

[Karsten Iwen · Accepted solution]

Your problem looks like if you have an ASA between your mail-server and your ESA. If that is the case, check if you have "inspect esmtp" configured on the ASA. That could cause these problems.

[petepalmer51]

Thanks, Karsten. This appears to be exactly the issue. We learned that our network team replaced an ASA about a month ago coinciding with the start of this issue. They left the default global setting to "inspect esmtp" unchanged. They will be modifying this setting to bypass traffic from our internal hub transport servers to the Email Security Appliances. Not completed yet but users have the workaround of sending to fewer than 100 recipients at a time.