Ironport delivery expired issue

[m.abdelaty87]

We are running Cisco IronPort AsyncOS 9.7.0 .

When trying to send to some domains bounced with Delivery has failed to these recipients or groups.

in the Diagnostic information for administrators part I see that this message is generated from the Ironport and also see #< #5.0.0 smtp; 5.4.7 - Delivery expired (message too old) '250A' (delivery attempts: 0)> #SMTP#

[Libin Varghese]

Hi,

The error would suggest the ESA was unable to connect to the destination server and hence the email was hard bounced after retry attempts configured on the bounce profile.

You can confirm this by using "hoststatus" command for the affected domain and attempting to telnet the IP address of the destination server over port 25.

Thanks!

Libin Varghese

[m.abdelaty87]

Hi,

I did the “hoststutus” command for the affected domains and the output was down but when I did telnet on port 25 it connected successfully

Also be informed that when I send to the affected domains from my Gmail account it successfully send.

Thanks

Mohamed Abdelaty

[Libin Varghese]

Hi Mohamed,

The hoststatus can be down if there are TLS negotiation errors, DNS lookup errors as well.

You can set up a packet capture for the destination server IP from GUI Help and Support -> Packet Capture to determine what the reason for the error is.

Thanks!

Libin V

[m.abdelaty87]

Hi Libin 

I took a packet capture for sending mail to affected domain.

Can you tell me ,which packets I need to focus on them  to extract the reason for that issue?

Thanks

Mohamed Abdelaty

[Libin Varghese]

Hi,

If the packet capture was set for the destination IP of the affected domain you would see traffic between the ESA IP and that destination IP.

Right clicking on any one such packet -> Right click -> Follow TCP stream will help filter out details for a single connection.

If you require troubleshooting assistance I would recommend opening a TAC case to get that capture reviewed.

Thanks!

Libin Varghese