3

So one of the Exchange 2003 servers I admin seems to be having trouble with sending e-mail to another domain's email server. As per my SMTP log (in NCSA format) this is what I have

66.195.209.243 - OutboundConnectionResponse [27/Apr/2011:13:33:54 -0500] "- -?220 destination.domain.com ESMTP SonicWALL (7.2.1.2841) SMTP" 0 53
66.195.209.243 - OutboundConnectionCommand [27/Apr/2011:13:33:54 -0500] "EHLO -?source.domain.com SMTP" 0 4
66.195.209.243 - OutboundConnectionResponse [27/Apr/2011:13:33:54 -0500] "- -?250 destination.domain.com SMTP" 0 24
66.195.209.243 - OutboundConnectionResponse [27/Apr/2011:13:33:54 -0500] "- -?250-8BITMIME SMTP" 0 12
66.195.209.243 - OutboundConnectionCommand [27/Apr/2011:13:33:54 -0500] "QUIT - SMTP" 0 4
66.195.209.243 - OutboundConnectionResponse [27/Apr/2011:13:33:54 -0500] "- -?221 2.0.0 Bye SMTP" 0 13

As one can see from the log, for some reason (which I would like to know) when the destination domain server sends back a response to the EHLO command, my server decides to send a QUIT command. The log doesn't show the full output of the response to the EHLO SMTP command so I'm going to post a manual telnet session to the destination smtp server...

220 filter.destination.domain.com ESMTP SonicWALL (7.2.1.2841)
EHLO server1.source.domain.com
250-filter.destination.domain.com
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-STARTTLS
250 SIZE
MAIL FROM: administrator@source.domain.com
501 5.1.8 Bad address syntax
MAIL FROM: <administrator@source.domain.com>
250 2.1.0 MAIL ok
RCPT TO: administrator@destination.domain.com
501 5.1.8 Bad address syntax
RCPT TO: <administrator@destination.domain.com>
250 2.0.0 Ok
DATA
354 3.0.0 End Data with <CR><LF>.<CR><LF>
**removed as irrelevant**
250 2.6.0 message received
QUIT
221 2.0.0 Bye


Connection to host lost.

From the manual SMTP session it seems everything goes through fine. So my hunch is that one of the responses by the destination server in (posted again below) 

250-filter.destination.domain.com
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-STARTTLS
250 SIZE

is causing my server to QUIT the connection. Would that be correct? What settings on my Exchange 2003 SMTP connector QUIT the connection in response to those 4 lines?

any help would be much appreciated

P.S. While I was typing this out I realized that the 250 SIZE response has no parameter. Is it ok for a server to respond with 250 SIZE and no size value?

warren
  • 18,369
  • 23
  • 84
  • 135
Archit Baweja
  • 280
  • 7
  • 17
  • Did you do this telnet from the server having trouble or from a different computer? According to RFC1870, SIZE with no parameter lets the client know that it can use `MAIL FROM: ... SIZE=...` but does not tell the client what (if any) maximum size has been set. – DerfK Apr 27 '11 at 19:31
  • Yes, I did the telnet from the same exchange server. – Archit Baweja Apr 28 '11 at 14:24
  • Another update. I created an SMTP connector just for destination.domain.com so that I could play with the "HELO instead of EHLO" setting. No difference. As soon as the destination.domain.com returns a 250 to my source.domain.com, my server sends the QUIT command. Confirmed via Wireshark capture too. – Archit Baweja Apr 28 '11 at 17:40

1 Answers1

3

Alrighty then.... So I guess we figured out the problem.

On further analysis, not ALL emails were being rejected. Emails were going through to the destination.domain.com, however only emails which were "Outlook Meeting Updates" were getting stuck in the queue. Armed with that piece of info I was able to google search and surprisingly get an instant hit here; which referred me to this MS KB article.

With that in mind the SMTP logs become clear why the source.domain.com server would initiate the connection but stop with a QUIT. Presumably, after initiating the exchange server hands over control to the another thread/process responsible for loading up the email message to send, but would get an error and subsequently fail, as is evident from the logging suggested in the MS KB article. The initial thread/process responsible for the SMTP connection would then recover from the error by closing the SMTP connection properly; all the while leaving someone like me looking at the SMTP logs for an answer, completely baffled!!!

P.S. Figured I'd leave this info here for future updates.

P.P.S Could we also maybe get an admin to update the question so it is 'categorized' better?

Archit Baweja
  • 280
  • 7
  • 17
  • you can *always* make edits to your own question (though a brand new tag is not possible till you hit the 150pt rep threshold) – warren Apr 29 '11 at 17:20
  • warren, thanks for that tip. On second thought though, I will leave the title just like that so that if someone else is having a similar problem they'll have a higher chance of getting a search hit. – Archit Baweja Apr 29 '11 at 21:20