Messaging Gateway

 View Only
  • 1.  SMG 10.6.1-3 and 421 esmtp: protocol deviation

    Posted Jun 03, 2016 07:42 AM

    Hi!

    I have some customers reporting that mail bounce back when sending to our SMG.

    One error is like this:

    ML-HOST_CONNECTED: xxx.xxx.xxx.xx:33834 connected. (ID: 7fbe99ff1700) 
    LUA: ML-CONNECT-INFO: connect from  xxxxx.xxx[xxx.xxx.xxx.xx] 
    1464877464|c0a800de-a13ff70000004856-f3-57504198e58b|ACCEPT|xxx.xxx.xxx.xx:33834
    ESMTP-03301 421 esmtp: protocol deviation [fd=41] 
    ML-HOST_DISCONNECTED: xxx.xxx.xxx.xx:33834 disconnected. (ID 7fbe99ff1700)
    ML-HOST_CONNECTED: xxx.xxx.xxx.xx:57008 connected. (ID: 7fbec4a676c0) 
    LUA: ML-CONNECT-INFO: connect from  xxxxx.xxx[xxx.xxx.xxx.xx] 
    MQ-01116 #sms#00004411 binding 0 
    ML-REJECT: Rejection on: xxx.xxx.xxx.xx:25, sent to host: xxx.xxx.xxx.xx:57008, Audit ID c0a800de-a13ff70000004856-f4-57504198669d, 450 4.3.2 try again later#015 
    1464877464|c0a800de-a13ff70000004856-f4-57504198669d|ACCEPT|xxx.xxx.xxx.xx:57008
    1464877464|c0a800de-a13ff70000004856-f4-57504198669d|IRCPTACTION|<none>|msg_reject_other
    ESMTP-03297 450 4.3.2 try again later#015  [fd=41] 
    ML-HOST_DISCONNECTED: xxx.xxx.xxx.xx:57008 disconnected. (ID 7fbec4a676c0)

    I know esmtp: protocol deviation is because of not compliant RFC. But I think this should have been fixed in SMG. The error code 421 I cant explain.

    I really need help with this. Would add IP or sender email address to good sender list work as a short term fix?

    More info:

    I have 2 SMG with DNS round robin and I recieve about 50000 mail a day and 89% is spam or virus related. My SMG are VMWare and not stressed at all from what I can see.

     

    BR

    Jonas



  • 2.  RE: SMG 10.6.1-3 and 421 esmtp: protocol deviation

    Posted Jun 06, 2016 02:06 AM

    Hi Jonas,

    I think you can forget about the "protocol deviation" - this info/error can be seen when the sending ip is triggering freq_sa or eg rdns-validation temporary cant reach the configured dns-servers.

    Have you checked the reputation of the sending ip incl ext rbls?

    If the error is reproducable with one ip, use tcpdump - perhaps tls-issues cert related.

    Regards

    Thomas