"Relay access denied" ESA 300V message delivery error

[Kanat Nurzhanov]

Hello. I set up ESA 300V, with one interface and one listener for both incoming and outgoing email traffic.

I added RELAYLIST sender group with the IP address of the Forcepoint MTA to the HAT table.

When I try to send mail from outside, I receive following error in message tracking:

(DCID 418) Message 63 to sub@sub.domain.com delayed. Reason: 4.1.0 - Unknown address error ('454', ['4.7.1 <sub@sub.domain.com>: Relay access denied'])

What am I doing wrong?

[Libin Varghese · Accepted solution]

Hi Kanat,

Could you clarify if you are testing emails going out or emails coming in from the internet?

The HAT Relaylist is checked when the incoming connection to the ESA ICID is created with the ESA. From the message tracking details we see the DCID which would suggest the ESA accepted the connection without issues and processed the email through the workqueue.

After the workqueue processing the ESA would attempt the delivery connection (DCID) and the destination server is rejecting the email with the provided error message.

A couple of articles on the error that may be helpful to you:

https://bobcares.com/blog/454-4-7-1-relay-access-denied/

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_outlook-mso_windows8/server-error-454-471-mail-address-sending-to-relay/29cf3de5-bee7-4f15-88c5-728c91fdfb41?auth=1

Regards,

Libin Varghese