Exchange SBS 2003 server stopped receiving mail over the weekend, senders getting "Relay access denied" error

Question

Firstly, I should say that I know my way around Windows very well, I don't really know the first thing about Exchange.

I am trying to support a user that is running an SBS2003 Server with Exchange. Over the weekend, everyone sending something to any of his addresses gets an error message like the following:

Delivery to the following recipient failed permanently:

        recipient@jfzassoc.com

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 554 554 5.7.1 <recipient@jfzassoc.com>: Relay access denied (state 14).

    ----- Original message -----

    Received: by 10.114.18.7 with SMTP id 7mr5572745war.127.1275423472120; Tue, 01
           Jun 2010 13:17:52 -0700 (PDT)
    MIME-Version: 1.0
    Sender: me@gmail.com
    Received: by 10.143.10.15 with HTTP; Tue, 1 Jun 2010 13:17:32 -0700 (PDT)
    From: My Name <me@m3fs.com>
    Date: Tue, 1 Jun 2010 15:17:32 -0500
    X-Google-Sender-Auth: XiPrP8Em_6Eb94EH9m84nJVGvCY
    Message-ID: <AANLkTilhapuE40nQVCSPFe1I9PY2AwuVg8hj1UQt139l@mail.gmail.com>
    Subject: TEST
    To: Client <recipient@jfzassoc.com>
    Content-Type: multipart/alternative; boundary=001636b1484ffe72470487fdaa5b

There are a host of errors in the Application log, but nothing that leaps out at me as being obvious. But then again, I don't really know what I'm looking for.

Any help would be greatly appreciated.

EDIT: Here is the results from the first suggestion below:

MX-VERIFY-CGI run for ``jfzpsyd@jfzassoc.com''


--------------------------------------------------------------------------------

Doing resolver lookup for T=MX domain=``jfzassoc.com''

DNS yields following MX entries 
  jfzassoc.com  (7200s) IN MX  20 sbssrv.jfzassoc.com
  jfzassoc.com  (7200s) IN MX  30 mx1.dnsmadeeasy.com
  jfzassoc.com  (7200s) IN MX  40 mx2.dnsmadeeasy.com
  jfzassoc.com  (7200s) IN MX  50 mx3.dnsmadeeasy.com




--------------------------------------------------------------------------------

Testing MX server: sbssrv.jfzassoc.com
Address lookup did yield following ones: 


  IPv4 173.15.20.182


Testing server at address: IPv4 173.15.20.182

ERROR: Connect failure reason: Connection timed out

(Still possibly all OK!)



--------------------------------------------------------------------------------

Testing MX server: mx1.dnsmadeeasy.com
Address lookup did yield following ones: 


  IPv4 66.231.182.63
  IPv4 66.231.182.64
  IPv4 66.231.182.80
  IPv4 66.231.182.35


Testing server at address: IPv4 66.231.182.63
[ CONNECTED! ]


 220 mx1cm.dnsmadeeasy.com ESMTP DNS Made Easy Messaging
 EHLO vger.kernel.org
 250-mx1cm.dnsmadeeasy.com
 250-PIPELINING
 250-SIZE 31457280
 250-VRFY
 250-ETRN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN


Excellent! It speaks ESMTP!

 MAIL FROM:<>
 250 2.1.0 Ok


Fine, it accepts NULL return-path as is mandated by RFC 2821 section 6.1

 RSET
 250 2.0.0 Ok
 MAIL FROM:<postmaster@vger.kernel.org>
 250 2.1.0 Ok
 RCPT TO:<jfzpsyd@jfzassoc.com>
 554 5.7.1 <jfzpsyd@jfzassoc.com>: Relay access denied


Something WRONG!! rc=554

Testing server at address: IPv4 66.231.182.64
[ CONNECTED! ]


 220 mx1cm.dnsmadeeasy.com ESMTP DNS Made Easy Messaging
 EHLO vger.kernel.org
 250-mx1cm.dnsmadeeasy.com
 250-PIPELINING
 250-SIZE 31457280
 250-VRFY
 250-ETRN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN


Excellent! It speaks ESMTP!

 MAIL FROM:<>
 250 2.1.0 Ok


Fine, it accepts NULL return-path as is mandated by RFC 2821 section 6.1

 RSET
 250 2.0.0 Ok
 MAIL FROM:<postmaster@vger.kernel.org>
 250 2.1.0 Ok
 RCPT TO:<jfzpsyd@jfzassoc.com>
 554 5.7.1 <jfzpsyd@jfzassoc.com>: Relay access denied


Something WRONG!! rc=554

Testing server at address: IPv4 66.231.182.80
[ CONNECTED! ]


 220 mx1cm.dnsmadeeasy.com ESMTP DNS Made Easy Messaging
 EHLO vger.kernel.org
 250-mx1cm.dnsmadeeasy.com
 250-PIPELINING
 250-SIZE 31457280
 250-VRFY
 250-ETRN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN


Excellent! It speaks ESMTP!

 MAIL FROM:<>
 250 2.1.0 Ok


Fine, it accepts NULL return-path as is mandated by RFC 2821 section 6.1

 RSET
 250 2.0.0 Ok
 MAIL FROM:<postmaster@vger.kernel.org>
 250 2.1.0 Ok
 RCPT TO:<jfzpsyd@jfzassoc.com>
 554 5.7.1 <jfzpsyd@jfzassoc.com>: Relay access denied


Something WRONG!! rc=554

Testing server at address: IPv4 66.231.182.35
[ CONNECTED! ]


 220 mx1cm.dnsmadeeasy.com ESMTP DNS Made Easy Messaging
 EHLO vger.kernel.org
 250-mx1cm.dnsmadeeasy.com
 250-PIPELINING
 250-SIZE 31457280
 250-VRFY
 250-ETRN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN


Excellent! It speaks ESMTP!

 MAIL FROM:<>
 250 2.1.0 Ok


Fine, it accepts NULL return-path as is mandated by RFC 2821 section 6.1

 RSET
 250 2.0.0 Ok
 MAIL FROM:<postmaster@vger.kernel.org>
 250 2.1.0 Ok
 RCPT TO:<jfzpsyd@jfzassoc.com>
 554 5.7.1 <jfzpsyd@jfzassoc.com>: Relay access denied


Something WRONG!! rc=554


--------------------------------------------------------------------------------

Testing MX server: mx2.dnsmadeeasy.com
Address lookup did yield following ones: 


  IPv4 208.94.147.129


Testing server at address: IPv4 208.94.147.129
[ CONNECTED! ]


 220 mx2.dnsmadeeasy.com ESMTP TiggeeSMTP (1.0.2.0002.1)
 EHLO vger.kernel.org
 250-mx2.dnsmadeeasy.com
 250-PIPELINING
 250-SIZE 30240000
 250-VRFY
 250-ETRN
 250-ENHANCEDSTATUSCODES
 250-8BITMIME
 250 DSN


Excellent! It speaks ESMTP!

 MAIL FROM:<>
 250 2.1.0 Ok


Fine, it accepts NULL return-path as is mandated by RFC 2821 section 6.1

 RSET
 250 2.0.0 Ok
 MAIL FROM:<postmaster@vger.kernel.org>
 250 2.1.0 Ok
 RCPT TO:<jfzpsyd@jfzassoc.com>
 554 5.7.1 <jfzpsyd@jfzassoc.com>: Relay access denied


Something WRONG!! rc=554


--------------------------------------------------------------------------------

Testing MX server: mx3.dnsmadeeasy.com
Address lookup did yield following ones: 


  IPv4 67.19.109.170


Testing server at address: IPv4 67.19.109.170

ERROR: Connect failure reason: Connection refused

(Still possibly all OK!)


--------------------------------------------------------------------------------

score 1 · Answer 1 · answered Jun 01 '10 at 21:27

1

Looks like their own mail server is unavailable and things are falling back to their alternative MX addresses which are not configured correctly to receive mail for this domain.

Try out the free mxverify tool at http://www.zmailer.org/mxverify and put in the domain name to see several scripted tests and their detailed results. This is a great tool for this kind of stuff.

answered Jun 01 '10 at 21:27

AdamV

2,021
1
11
4

I have added the results from your suggestion above. It's all Greek to me... any suggestions? – Jun 02 '10 at 14:43

score 1 · Answer 2 · answered Jun 02 '10 at 15:25

1

I agree with AdamV, the mail server, sbssrv.jfzassoc.com is not accepting connections, so the mail is going to the dnseasy servers (Via the MX priority) and they are not setup for your domain.

Since the connection to sbssrv.jfzassoc.com failed, lets start there. Can you ping the server? Can you verify that it is running? Are all Exchange services running? The Address listed for sbssvr is a public address, from inside the network, can you hit the internal address? If so then this points to a routing issue.

answered Jun 02 '10 at 15:25

BillN

1,503
1
13
31

I can not ping sbssrv.jfzassoc.com externally, but I don't know for a fact that I could previously. However, I can not VPN into the server, it never makes a connection. It is definitely running, though. I have LogMeIn access to the server and a desktop in the same office. I can connect to Exchange via an account in Outlook from the internal Desktop. For what it's worth, I can send email out fine through said Exchange account. I don't see any services not running that are an obvious issue to me. – Jun 02 '10 at 17:05
I think I've figured it out, based on your recommendations. The client told me that the problem happened started over the weekend, and there was a big storm in his area. I checked the router in his office, and it looks like it got set back to defaults. In other words, there are no port forwards set up. Is there a default set of ports that Exchange SBS 2003 uses, or do I need to figure out his custom settings? – Jun 02 '10 at 17:10
Should be 25 for mail and 80/443 if OWA was set up. I *think* that should be all. – Ben Pilbrow Jun 02 '10 at 19:31

score 1 · Answer 3 · answered Jun 02 '10 at 19:17

The issue turned out to be that the router in the office somehow (power loss, surge, etc.) got reset to defaults, and got a new IP address to boot. I changed the routing of the sub-domain on the client's host to the new IP address, and recreated all of the necessary port forwards in the router settings. Once the IP change made it through my DNS servers, everything started to work again.

I need to find out if the old IP address was static (which it should have been) and needs to be reconfigured on the router in place of the dynaim one, but I can do that later at night once I know for sure.

Thanks to BillN and AdamV for the help! :)

Exchange SBS 2003 server stopped receiving mail over the weekend, senders getting "Relay access denied" error

3 Answers3

Linked