cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.1-033
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.1.0-227
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

2825
Views
0
Helpful
7
Replies
Anilkumar48
Beginner

Delivery Status: ABORTED

Hello Leads, 

 

One of SMTP domain is trying to send an email to our users but I found this "Delivery Status: ABORTED" 

 

Message 20309186 aborted: Receiving aborted by sender.

Message 20309186 Delivery Status: ABORTED

However, this sender domain IP address is already in the whitelist sender group. I checked my grey-list mail flow policy too, but, did not find much. 

Please advise. 

7 REPLIES 7
Mathew Huynh
Cisco Employee

Hey Anilkumar,

 

Receiving aborted by sender could be down to multiple things.

Can i get the extract of the mail_logs/tracking (you can remove the sensitive information for privacy purposes).

 

Essentially if we see aborted after 5 minutes, then it could be the case of a TCP timeout (silent TCP drops occurring or slow TCP transfer).

If we see aborted abruptly, it's likely due to something on the traffic being stopped and connection forcefully cut.

 

In most cases if this sender is NOT using TLS, you can run a packet capture and verify at which point it fails.

If they are using TLS - the logs may yield some SSL errors.


Lastly, you could also try an injection debug log (GUI > Log Subscriptions -> Add a New Log -> Injection Debug -> Insert their sending IP) and have the issue get recreated and the injection debug would give you some valuable info here.

 

Regards,

Mathew

Thank you, Mathew for picking my query. However, I have attached the trace report to look into it. 

 

Regards

Anil Bhardwaj

Hey Anil,

 

Going off this error - it looks like it was happening after TLS negotiation and transaction of  the mail data.

However I suspect if we ran a packet capture when the issue was happening to verify the negotiation, something might have happened during the TLS transaction that caused the sender to abruptly close the connection.

 

Regards,

Mathew

Hello Mathew, 

 

Thank you so much. 

 

You have given me a clue about the issue. I'll do further investigation and keep you posted here. 

 

Regards

Anil 

Hi Team,

We are facing this issue in ESA. pleas advise. Also see that random emails got aborted in ESA and other emails from the same IP delivered to our users.

Hi Siva,

 

Looks like, the emails aborted due to no recipient email address. 

Also, the sender IP triggered to THROTTLE1_LIST. Generally, throttle Sender Group (Mail Policies >> HAT Overview) accepts few connections from the sending IP. 

Hi Team,
Issue is not with the recipient address, it seems something issue on sender side. Some of emails come in and some of them not come in.
I suspect issue with reverse DNS verification on ESA side. I can also verify the PTR for the sender IP in MXtoolbox. I think, we need to dig more on ESA throttle side?
Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: pxGrid (39%)

Content for Community-Ad