RE: SMTP Outgoing - Connection Dropped

Thanks Nathan, your response was helpful in tracking the issue. You were
right in saying it was a DNS issue.

I had my email and website with Ozehosting who were directing everything to
my fixed IP connection with Telstra. I had trouble getting Ozehosting to
provide a Reverse DNS entry, so Telstra entered one in their system.

While it semms to work and you can verify it, some SMTP receiving servers
see the difference and do not trust you.

I got Telstra to remove the entry, cancelled my account with OzeHosting,
created a new Name Server account with Internode who also provided the
Reverse DNS entry and everything is fixed. Even the UDP/TCP errors that you
highlighted using SMTPDiag are gone.

I got Internode to provide the NS because I was informed by a private IT
company that it was not safe to host my own NS. Also I could not get the NS
to work locally. I got stuck on the issue that my internal domain is called
desscabs.local and my public domain is des.com.au.

Can you host two domain zones on the one DN server and is it secure?

Anyway, thanks for your help, it was much appreciated.

Brett

""Nathan Liu [MSFT]"" wrote:

> Hello Brett,
>
> Thank you for posting in the SBS newsgroup.
>
> According to your description, I understand that you cannot send email to
> certain domain names and received the error message "The connection was
> dropped by the remote host". If I have misunderstood your concern, please
> don't hesitate to let me know.
>
> I appreciate you have done some troubleshoot for this issue and shared
> these log files.
>
> To narrow down this issue, please answer and perform the following
> questions and steps:
>
> 1. I have checked the Server log file, telnet process, there are no
> problem. Then checked the result of the SMTP diag, find this:
>
> Checking TCP/UDP SOA serial number using DNS server [139.130.4.4].
> TCP test failed.
> UDP test succeeded.
> Serial number: 2005030201
>
> Checking TCP/UDP SOA serial number using DNS server [203.50.2.71].
> TCP test failed.
> UDP test succeeded.
> Serial number: 2005030201
>
> Two TCP test failed. The SMTP diag tool check the MX, A record of the
> internal and remote domain, no problem.
>
> Based on my research, if the Telnet to the destination domain works, but
> cannot send email to the certain problematic domain names, it is most
> likely a DNS issue. Since this issue only occurs with certain domain names,
> so the reason maybe is: some of mail servers in the Internet will perform a
> reverse lookup when a SMTP connection is established. If the mail server
> does not get the correct info from the reverse lookup, it will drop the
> connection. So please contact your ISP to check the DNS records for your
> domain to make sure that your Exchange server has a correct reverse DNS
> record (PTR record).
>
> 2. If this issue is that they can't send email to some domains and the
> NDR is as follows:
> #5.5.0 smtp;571 from IP Address We do not relay
>
> a. Check if it's actually the remote mail server denies the queuing
> request? If so, one should get a Smart Host or get the remote Mail server
> exclude their IP from the black list.
>
> b. There're some cases that the outgoing SMTP traffic goes to a different
> server instead of the one defined. This kind of issue may be caused by the
> name resolution. When the SBS server delivers the outgoing messages through
> smarthost, the server queries the MX record of the FQDN of the smarthost
> address. If the MX record of the Smart Host is different from the A record,
> this will occur, Suggestion is to use the IP address as the smarthost
> address.
>
> ISPs so far are:
> BellSouth (dsl)
> DirectWay (satellite)
> Roges/Yahoo (dsl)
>
> 3. Please follow the KB 285863 to create a testing SMTP connector to by
> Bypass DNS Name Resolution to Test SMTP Mail Flow to Remote Domains:
>
> A. Open Exchange System Manage.
> B. Create a SMTP connector.
> C. Open the SMTP connector properties, click the General tab, and then
> type the IP address of the SMTP server that you cannot send to.
> Note: Format the address so that it is enclosed in brackets, for example
> "[157.60.112.123]".
> D. Adjust the cost so that messages will go through this connector.
> E. Click Address Space, add SMTP address Company2.com at this window.
> F. Stop the Microsoft Exchange Server Routing Engine Service and the SMTP
> service.
> G. Restart both services.
> H. Send test messages to the problematic domain.
> I. Can you send the messages now?
>
> For the detailed information, see the following KB articles:
>
> XCON: How to Bypass DNS Name Resolution to Test SMTP Mail Flow to Remote
> Domains
> http://support.microsoft.com/?id=285863
>
> HOW TO: Install and Configure SMTP Connectors in Exchange 2000 Server
> http://support.microsoft.com/?id=314961
>
> 4. Based on my experience, some software can prevent ESMTP commands such
> as EHLO. However, Exchange is using ESMTP by default to initiate an ESMTP
> conversation with the receiving Mail Server computer. If the commands are
> filtered by the software, mail transfer fails and the message will be
> logged.
>
> Moreover, if you have ISA server between Exchange and then Internet, please
> disable any SMTP filter rules on ISA. If you have Cisco PIX Firewall, you
> also need to disable the Mail Guard feature on the Cisco PIX firewall. More
> info here:
> 320027 XCON: Cannot Send or Receive E-Mail Messages Behind a Cisco PIX
> Firewall
> http://support.microsoft.com/?id=320027
>
> You can also try the following steps to test this issue.
>
> a. Open Exchange System Manager (ESM).
> b. Expand to Administrative Groups->first administrative group->Routing
> Groups->first routing group->Connectors->SMTP Connector.
> c. Right-click SMTP Connector and then click Properties.
> d. Click Advanced.
> e. Click to select Send "HELO instead of EHLO" and then click OK.
> f. Restart all Exchange related services and test this issue again.
>
> 5. What's the error message when the user tries to send email to the
> certain problematic domain names? Is there any NDR (Non-Delivery Report)?
> If yes, I would appreciate your time to forward one of them to me at
> v-natliu@xxxxxxxxxxxxxx
>
> 6. Please enable SMTP logging and gather SMTP log to troubleshoot the
> issue:
>
> A. Open Exchange System Manager, expand Servers -> <Server name> ->
> Protocols -> SMTP, right-click "Default SMTP Virtual Server" and click
> Properties.
>
> B. Under the General tab, check the option "Enable Logging".
>
> C. With "W3C Extended Log File Format", click "Properties".
>
> D. Under "General Properties", make sure "Use local time for file naming
> and rollover" is CHECKED.
>
> E. Switch to the "Extended Properties", and then select to enable All the
> logging Options.
>
> F. Click OK to apply the modification.
>
> G. Right-click Default SMTP Virtual Server and click Stop.
>
> H. Right-click Default SMTP Virtual Server and click Start to restart the
> SMTP server.
>
> I. Reproduce the issue, repeat step G to stop Default SMTP Virtual Server,
> copy out or zip the SMTP log files in the
> "%systemroot%\system32\logfiles\SmtpSvc1" folder, and then restart the
> "Default SMTP Virtual Server".
>
> 7. Please enable message tracking, send an testing email to the certain
> problematic domain names and then check the email message under
> Tools->Message Tracking Center (you can make a screen capture of the
> tracking result and upload the picture here). Regarding how to enable
> Message Tracking, please refer to the following MS KB article:
>
> 246856 XADM: How to Enable Message Tracking in Exchange 2000 Server
> http://support.microsoft.com/?id=246856
>
> I am appreciated your time and cooperation. If anything is unclear, please
> feel free to let me know. I am looking forward to hearing from you.
>
> Best regards,
>
> Nathan Liu (MSFT)
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>
> When opening a new thread via the web interface, we recommend you check the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> --------------------
> >Thread-Topic: SMTP Outgoing - Connection Dropped
> >thread-index: AcWX/FMExgCq1XCESr+gZAcfzFzdAg==
> >X-WBNR-Posting-Host: 203.122.199.124
> >From: "=?Utf-8?B?QnJldHQgQnJvdWdoYW0=?=" <Brett
> Brougham@xxxxxxxxxxxxxxxxxxxxxxxxx>
> >Subject: SMTP Outgoing - Connection Dropped
> >Date: Wed, 3 Aug 2005 00:24:03 -0700
> >Lines: 354
> >Message-ID: <518A52FF-7107-4849-B5D5-CB526BCF0CFD@xxxxxxxxxxxxx>
> >MIME-Version: 1.0
> >Content-Type: text/plain;
> > charset="Utf-8"
> >Content-Transfer-Encoding: 7bit
> >X-Newsreader: Microsoft CDO for Windows 2000
> >Content-Class: urn:content-classes:message
> >Importance: normal
> >Priority: normal
> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
> >Newsgroups: microsoft.public.windows.server.sbs
> >NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
> >Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
> >Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:141043
> >X-Tomcat-NG: microsoft.public.windows.server.sbs
> >
> >Hi
> >
> >I have the same problem that was listed by teksysman on the 07/25/2005
> "The
> >coonection was dropped by the remote host". This only occurs with certain
> >domain names and never with others. I can send a successful email using
> >Telnet to any of the domains that are giving me grief.
> >
> >I have directed my ISP to direct everything to do with our domain
> >'des.com.au' to our site.
> >
> >This has been a 6 week battle and I am not winning! Help, Please!
> >
> >Included below is Server Log of Email through Exchange, then with Telnet,
> >and then SMTPDiag. I apologise for the length of this email, but thought
> it
> >better to include the data.
> >
> >The Server Log File records the following when sending email from
> >brett@xxxxxxxxxx to carolmundy@xxxxxxxxxxxxxxxxxx
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionResponse SMTPSVC1
> SLAVE
> >- 25 - - 220+secmx1.sa.chariot.net.au+ESMTP+Postfix 0 0 42 0 32 SMTP - - -
> -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionCommand SMTPSVC1 SLAVE
> -
> >25 EHLO - des.com.au 0 0 4 0 32 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionResponse SMTPSVC1
> SLAVE
> >- 25 - - 250-secmx1.sa.chariot.net.au 0 0 28 0 63 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionCommand SMTPSVC1 SLAVE
> -
> >25 MAIL - FROM:<brett@xxxxxxxxxx>+SIZE=1497 0 0 4 0 63 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionResponse SMTPSVC1
> SLAVE
> >- 25 - - 250+Ok 0 0 6 0 110 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionCommand SMTPSVC1 SLAVE
> -
> >25 RCPT - TO:<carolmundy@xxxxxxxxxxxxxxxxxx> 0 0 4 0 110 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionResponse SMTPSVC1
> SLAVE
> >- 25 - - 250+Ok 0 0 6 0 500 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionCommand SMTPSVC1 SLAVE
> -
> >25 DATA - - 0 0 4 0 500 SMTP - - - -
> >2005-08-02 20:30:53 203.87.93.130 OutboundConnectionResponse SMTPSVC1
> SLAVE
> >- 25 - - 354+End+data+with+<CR><LF>.<CR><LF> 0 0 35 0 532 SMTP - - - -
> >
> >The following works from the command prompt on the server.
> >TELNET secmx1.vic.chariot.net.au 25
> >220 secmx1.vic.chariot.net.au ESMTP Postfix
> >EHLO des.com.au
> >250-secmx1.vic.chariot.net.au
> >250-PIPELINING
> >250-SIZE 18000000
> >250-ETRN
> >250 8BITMIME
> >MAIL FROM:brett@xxxxxxxxxx
> >250 Ok
> >RCPT TO:carolmundy@xxxxxxxxxxxxxxxxxx
> >250 Ok
> >DATA
> >354 End data with <CR><LF>.<CR><LF>
> >Subject: Test
> >
> >Oh for a glass of scotch!
> >.
> >250 Ok: queued as 6E9AF3D2450
> >QUIT
> >221 Bye
> >Connection to host lost.
> >C:\>
> >
> >SMTPDiag shows the following...
> >
> >C:\>cd \clientapps\smtpdiag
> >
> >C:\ClientApps\SmtpDiag>smtpdiag brett@xxxxxxxxxxx
> >carolmundy@xxxxxxxxxxxxxxxxxx
> >/v
> >
> >Searching for Exchange external DNS settings.
> >Computer name is SLAVE.
> >VSI 1 has the following external DNS servers:
> >139.130.4.4,203.50.2.71
.

Relevant Pages

  • [NT] Vulnerability in Exchange Server Could Allow Arbitrary Code Execution (MS03-046)
    ... Get your security news from a reliable source. ... In Exchange Server 5.5, a security vulnerability exists in the Internet ... an unauthenticated attacker to connect to the SMTP port on an Exchange ...
    (Securiteam)
  • RE: SMTP error (only from Outlook)
    ... This issue appeared on specify user or all SMTP clients? ... If yes, in Exchange System ... Is there any local bridgehead server listed in "Local ... to over three dozen open relay block lists. ...
    (microsoft.public.windows.server.sbs)
  • RE: strange email errors
    ... you to check the relay configuration on the SBS server. ... please restart the SMTP virtue server and Exchange ... Please also refer to the following steps to create a new SMTP Connector to ...
    (microsoft.public.windows.server.sbs)
  • Re: Exchange 2003 SP2 - able to send but not receive email
    ... just Host SMTP using Exchange Server? ... No need to create the MX and PTR record on your internal DNS, ... product and not part of Exchange Server itself. ...
    (microsoft.public.exchange.admin)
  • Re: Exchange issues
    ... Are you up to date on all your Service Packs, both Windows and Exchange? ... > all traffic on port 25 to the SBS Exhange server. ... I suspected SMTP relaying becuase ... > You should verify that the server really isn't an open relay: ...
    (microsoft.public.exchange2000.admin)
Loading