cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2529
Views
0
Helpful
5
Replies

Email Security Appliance - Can't send message to certain domain

adnan ramadhan
Level 1
Level 1

Hi,

 

currently, my customer have some problem. They can't send message from their domain (let's said @test.com) to @example.com. everytime they send message, the message tracking will display like this :


07 Aug 2015 18:24:07 (GMT +07:00) Message 17387021 on incoming connection (ICID 15946724) added recipient (user@example.com).
07 Aug 2015 18:24:07 (GMT +07:00) Message 17387021 on incoming connection (ICID 15946724) added recipient (user.bb@check.com).

10 Aug 2015 19:02:27 (GMT +07:00) (DCID 24051766) Message 17387021 to xxx@abc12345.co.id bounced by destination server. Reason: 5.4.7 -
Delivery expired (message too old) ('000', ['timeout'])
10 Aug 2015 19:02:27 (GMT +07:00) Start message 17423295 on incoming connection (ICID 0).
10 Aug 2015 19:02:27 (GMT +07:00) A new message 17423295 was generated to handle bounce of message 17387021.
10 Aug 2015 19:02:27 (GMT +07:00) Message 17423295 enqueued on incoming connection (ICID 0) from .
10 Aug 2015 19:02:27 (GMT +07:00) Message 17423295 on incoming connection (ICID 0) added recipient (xxx@abc12345.co.id ).
10 Aug 2015 19:02:27 (GMT +07:00) Message 17423295 (7203 bytes) from ready.
10 Aug 2015 19:02:27 (GMT +07:00) Message 17423295 queued for delivery.
10 Aug 2015 19:02:27 (GMT +07:00) SMTP delivery connection (DCID 24051779) opened from IronPort interface x.x.x.x to IP address y.y.y.y on
port 25.
10 Aug 2015 19:02:27 (GMT +07:00) (DCID 24051779) Delivery started for message 17423295 to xxx@abc12345.co.id.
10 Aug 2015 19:02:28 (GMT +07:00) (DCID 24051779) Delivery details: Message 17423295 sent to xxx@abc12345.co.id
10 Aug 2015 19:02:28 (GMT +07:00) Message 17423295 to xxx@abc12345.co.id received remote SMTP response '2.6.0
<676377$gjmtv@mail.visionet.co.id> [InternalId=19444916] Queued mail for delivery'.

 

the message to user.bb@check.com was delivered, but the message can't be delivered to @example.com. 

Can someone explain what the reason behind this ?

Thank You.

 

5 Replies 5

Mathew Huynh
Cisco Employee
Cisco Employee

Hello,


Generally if emails go to one mail domain and not the other recipient mail domain, the tracking would be indicative of the reason:

 

In this particular instance : 10 Aug 2015 19:02:27 (GMT +07:00) (DCID 24051766) Message 17387021 to xxx@abc12345.co.id bounced by destination server. Reason: 5.4.7 -
Delivery expired (message too old) ('000', ['timeout'])

 

Email was hard bounced because the ESA could not reach the mail server of recipient domain @abc12345.co.id for an extended period of time.

 

I would suggest to review connectivity from the ESA to abc12345.co.id.

CLI > nslookup abc12345.co.id mx

Locate their MX records, attempt a connection to it telnet <ip/host> 25

It may generate a time-out which is what the ESA is reporting.

This is usually due to a network fault of some sort.

 

regards,

Matthew

"This is usually due to a network fault of some sort."

are you referring to problems like firewall not opening port for smtp(25) or something like denied by ACL ?

 

Thank you.

Hey Adnan,


As we do not have the bigger picture i cannot say, but within the scope of the ESA, as you're getting connection timeout to this domain, this means the SYN packet was sent out but no response of a SYN ACK


It could be a number of things but i would firstly suggest to check the next hop from the ESA out and see where this SYN is going and why there is not a SYN ACK

 

Regards,

Matthew

Hi Adnan,

I do see the same issue on my ESA and its' logs are identical as yours. What was the cause or what did you find out after this post?

Regards, Francisco 

Adding below article to assist with troubleshooting as needed.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118467-technote-esa-00.html

I'll let Adnan comment on what was determined in his particular scenario once he sees the query.

- Libin

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: