A third party service sends emails to us and spoofs our domain in the sender. This typically works without problems but a message that failed to deliver was recently brought to my attention. The message was sent on 02/03/2011, so I can't trace the message because the log has already rolled off of our appliance. (I have a case open for an unrelated log file FTP archive problem.) This is what the meat of the undeliverable notification looks like:
Generating server: [MyIM.MyBogusDomain.com]
#< #5.0.0 smtp; 510 None of the mail servers for the destination domain have so far responded.> #SMTP#
Does this mean that my IronMail appliance could not talk to our Exchange server on the back end at the time the message came in so it was rejected? Thanks!
I have a few additional reports of missing messages but the senders are reporting that they received no "undeliverable" notification at all--these messages just disappear. In examining the IronMail logs, I have found some information on two of the missing messages, but no information is available for them in the GUI. Looking at the summary log for that day reveals the following...
02082011 17:44:32|21|33718525|0|100|Message received. Received IP <('nnn.nnn.nnn.nnn', 46303)> From <Sender@SenderBogusDomain.com> To <['MyUser@MyBogusDomain.com']> Route Domain <MyBogusDomain.com> Route Host = <nnn.nnn.nnn.nnn,nnn.nnn.nnn.nnn>|
02082011 17:44:33|230|33718525|0|100|Message ripped successfully.|
02082011 17:44:33|200|33718525|0|100|No virus found in this message.|
02082011 17:44:33|220|33718525|0|100|No action|
02082011 17:44:33|210|33718525|0|100|No action|
02082011 17:44:36|30|MyBogusDomain.com:33718525|1|115|Invalid protocol response from destination mail server. Notification no: <1>.|
02082011 17:59:37|30|MyBogusDomain.com:33718525|1|115|Invalid protocol response from destination mail server. Notification no: <2>.|
02082011 21:44:38|30|MyBogusDomain.com:33718525|1|115|Invalid protocol response from destination mail server. Notification no: <3>.|
The "Invalid protocol response from destination mail server" error appeared against at least three messages on 02/08/2011. Other messages from the same sender to the same recipient are delivered without issue. Several questions come to mind... The "Invalid protocol response from destination mail server", is that an error that IronMail reporting as encountered when it attempts to pass the message to my internal Exchange server? Is this error related to the bounce message that one sender reported (in my original post)? The messages look like they could be related. I may have to open a case with support on this, but I'm still trying to determine how often this is being encountered by searching other logs. At this point, the problem is intermittent. Thanks!
There are 2 issues on v6.7.2.
I opened tickets and supports confirmed those as bugs half a year ago.
1. Incorrect DSN issue
2. 5xx Retry issue
According to my observations it seems that IronMail does not understandsome SMTP error codes such as 554, 552 and 421 reply to ehlo OR receiving one of those replies right after connection establishment in SMTP transactions.
I saw the similar issue in the observations.
In my case that was caused by exceeded message size.
Sender ---> IronMail ---> Dest mail server
The event log I saw was this.
“20100527:23:22:27|80133|9559|Failed to send msg. SMTP protocol error <err> -||”
DSN (created by IronMail) reported as
"510 Did not receive the expected protocol response" to Sender.
Dest mail server said
"552 Message exceeds fixed maximum message size" (confirmed in tcp dump)
to my IronMail and my IronMail kept retrying.
So I would check size limits for both IronMail and your dest mail server, and then
send test message which exceeds limit to see you would get the same error message.
Hope this will help.
Thanks helo. I also opened up a case with McAfee Support and the representative indicated the "Invalid protocol response from destination mail server" error is a known issue and the result of an oversize file attachment, like you said. My case is being escalated to development. I'm still waiting for information about the 510 message--confirmation that it is either related or unrelated. Right now I'm waiting to hear back.