Email Security.cloud

Hi,

We have one customer who is unable to send mails to us.  If they use a different domain, with a different mailserver and public IP, mail works fine.

I cannot see any mails in the portal which are being blocked and I have whiltelisted the senders domain, although I dont think in this case that will have any effect.

The logs I have received from the sending server are:

2017-03-23 15:12:31 1cr4Pf-001dOF-78 <= xyz@domain.co.uk H=(whuk101.redbackinternet.net) [127.0.0.1]:46795 I=[127.0.0.1]:25 P=esmtpa A=dovecot_login:xyz@domain.co.uk S=631 id=7cd01d794fbf0f59926f459a82a9cc00@domain.co.uk T="test" from <xyz@domain.co.uk> for user.name@recipientdomain.co.uk
2017-03-23 15:12:33 1cr4Pf-001dOF-78 H=cluster5a.eu.messagelabs.com [216.82.251.230]: SMTP error from remote mail server after RCPT TO:<user.name@recipientdomain.co.uk>: 421 Service Temporarily Unavailable
2017-03-23 15:12:33 1cr4Pf-001dOF-78 == user.name@recipientdomain.co.uk <user.name@recipientdomain.co.uk> R=dkim_lookuphost T=dkim_remote_smtp defer (-44) H=cluster5a.eu.messagelabs.com [216.82.251.230]: SMTP error from remote mail server after RCPT TO:<user.name@recipientdomain.co.uk>: 421 Service Temporarily Unavailable

You can see 421 Service Temporarily Unavailable.  No other customers are reporting this error, I have checked to see if the senders IP has been blacklisted and it doesnt look like it has (109.203.103.150).

How do we get this resolved?  Any help would be appreciated.  As a side note, cluster5a.eu.messagelabs.com is our secondary MX record and not primary - I find it a little strange that secondary is being used, as it has a higher weight.

Thanks,

Daniel

Hi Daniel

It looks as though their sending IP is being throttled by our services. This will happen when we have seen spam being sent from that IP in the past. If we see enough spammy activity then the throttling will get to a point where we will refuse a connection and force the sender to try the seconday MX record which is what is happening here.

I will clear the IP now however should we see further spammy behaviour from their IP then the throttling will go back up.

I will update you once the IPs been cleared.

Ian Tiller

Tier 2 Senior Technical Support Engineer

Hi Daniel

The throttling has now been removed so these should get sent through with no issues now, however as mentioned if we do see further spammy behaviour from this IP the throttling will increase again.

Ian Tiller

Tier 2 Senior Technical Support Engineer

Thanks Ian, I will let the customer know and test now.

Customer confirmed all is OK, thanks for your help.

Great news. As such could I ask you to mark this thread as resolved.

Thank you.

Ian Tiller

Tier 2 Senior Technical Support Engineer