I am having an issue with my Exchange 2003. It is on an SBS 2003 server SP1. All other services appear to be functioning fine.
The server receives email from some servers (eg hotmail comes through fine), fails with some others (I cannot receive confirmation mails from facebook), and it sends mail without isssue as well. When I run diagnostics on mxtoolbox.com I get the following:
Banner: work.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at Fri, 10 Aug 2007 23:11:48 +1000 [234 ms]
Connect Time: 0.234 seconds - Good
Transaction Time: 11 seconds - Not good!
Relay Check: OK - This server is not an open relay.
Rev DNS Check: OK - x.x.x.x resolves to work.com
GeoCode Info: Geocoding server is unavailable
Session Transcript: TIMEOUT after HELO mxtoolbox.com - DIAGNOSTIC TEST - See http://www.mxtoolbox.com/P
The whole conversation part that is usually in the "Session Transcript" just seems to be non-existant.
I can telnet to the servers port 25 when on the LAN and get a response to a HELO.
There are two other seperate exchange servers, is seperate domains behind my firewall, which have the exact same rules on the firewall and both return "good" results from mxtoolbox with a transaction time generally around 2 seconds.
I have been going insane tring to fin if there is some rule located somewhere that disallows telnet from external. I tried uninstalling my antivirus (CA Etrust ITM 8.0), but still had the same result. I found one article that suggested disabling RAS on the sbs server, which I have done but to no avail. I do not have a windows firewall enabled. The fact that some email still comes through just doesnt make sense to me. I would have though it should not work at all if i cannot telnet the port.
I can telnet port 80 from external IP addresses.
Does anyone know if I am missing something obvious? Is there some kind of logging I can enable to trap attempted telnet sessions? Is there some kind of "traceroute" thing I should be using?
Any help or advice will be very much appreaciated.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hi northcide
I have a cyberguard SG575... but as I said, there is two other servers behind it as well with the same rules, and they are fine. What you are saying makes sense, i will try recreating the rules on the firewall and see if that fixes it. Thanks for fixing my focus :)
will report back shortly
hmmmm, no luck. I have remade all rules relating to the server in question. I have tried disabling filter rules on the smtp Virtual server. I have rebooted everything I can between the machine and the internet. On the happy side of things, I did receive my notification from EE via email, so they seem to be able to talk to the server. Any other suggestions?
What results do you get with the dnsreport facility within dnsstuff.com? For example: Is there a backup mail server in place at your ISP which, by virtue of MX records setup, is receiving some of the mail when your server is busy, and this is chucking the mail back to the recipient because it is not recognizing the domain that it is ultimately destined for? (thinking that it is acting as an unauthorised relay and rejecting it for that reason). If this were the case I would expect random acceptance/rejection from any given source - you are seeing consistent acceptance from one source and consistent rejection from another.
Hi moorhouselondon,
Results of dns stuff: I had two fails, one with the mail server, the other with A records-
1) ERROR: I could not complete a connection to any of your mailservers!
mail.work.com: Timed out [Last data sent: RCPT TO: ]
If this is a timeout problem, note that the DNSreport only waits about 40 seconds for responses,
so your mail *may* work fine in this case but you will need to use testing tools specifically
designed for such situations to be certain.
2) ERROR: I couldn't find any A records for work.com But I did find a referral to www.work.com. (and
maybe others). If you want a website at work.com (as well as www.work.com), you
will need an A record for work.com. If you do not want a website at work.com,
you can ignore this error.
40 seconds should be way long enough, i get immediate response from the server when on the LAN, or when hitting websites from external...
I have a website at the www addresss, it works fine. I did an nslookup on the name server, and it is definitely there. I don't host anything at the straight work.com so i cannot see this being an issue. While doing nslookup I checked the results for my mail. address and that all look fine as well.
Unfortunately I don't have a backup mail server at my ISP any more, they disabled the service without telling me. This is what has bought light to the issue. As far as I can tell all mail that cound not get directly to our server was going through our secondary mx. I know i can purchase an alternative secondary as a workaround, but I would really like to fugure out what the issue is here.
I might try changing its IP address and run the connection wizard again, then change all my firewall rules. Maybe something has gotten itself confused (Like me :) ).
This sounds like a DNS problem. You need to look at the MX records for the domain and make sure (1) that there are no numerical IP addresses in there (2) the record that points to your ISP's backup server has been removed (3) that you have a reference to an entry# in the A records that, in turn, points to the IP address that you are routing mail in on your Router and (4) check that any other MX records listed in there (by the sound of it, there should be none), are there for a good reason. I take it that you didn't have any error regarding CNAME's so I don't need to say anything about these.
You can check these things using dnsstuff.com. Scroll right down and on the right-hand column (Hostname Tools), top entry (DNS Tools), you can check these things.
# e.g., mail, but it could be anything you like, so long as there's a corresponding entry in the A records.
OK.... found the issue. It was a TarpitTime registry setting on the SMTP service. It was causing a timeout. Seems some email servers out there have timeouts set below what our tarpit setting was, and others do not. Splitting points each way since both of you added to my knowlege in the area. Thanks for your time.
Business Accounts
Answer for Membership
by: northcidePosted on 2007-08-10 at 07:01:32ID: 19669862
doesnt sound like this has anything to do with exchange. if you can have a full conversation with port 25 from on your lan then it must be the fw that is the problem.
"telnet to port 25" is pretty much what happens when an email gets delivered to a server, so there wouldnt be a rule to stop 'telnet to port 25". as long as the port is open and the route exists it should work. if you have a cisco pix have you set the smtp fixup?