Exchange 2003 - cannot telnet port 25 from external IP address.

I am having an issue with my Exchange 2003. It is on an SBS 2003 server SP1. All other services appear to be functioning fine.
The server receives email from some servers (eg hotmail comes through fine), fails with some others (I cannot receive confirmation mails from facebook), and it sends mail without isssue as well. When I run diagnostics on I get the following:

Banner: Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at Fri, 10 Aug 2007 23:11:48 +1000 [234 ms]  
Connect Time: 0.234 seconds - Good
Transaction Time: 11 seconds - Not good!
Relay Check: OK - This server is not an open relay.
Rev DNS Check: OK - x.x.x.x resolves to
GeoCode Info: Geocoding server is unavailable
Session Transcript: TIMEOUT after HELO - DIAGNOSTIC TEST - See -- 10.531 seconds

The whole conversation part that is usually in the "Session Transcript" just seems to be non-existant.

I can telnet to the servers port 25 when on the LAN and get a response to a HELO.

There are two other seperate exchange servers, is seperate domains behind my firewall, which have the exact same rules on the firewall and both return "good" results from mxtoolbox with a transaction time generally around 2 seconds.

I have been going insane tring to fin if there is some rule located somewhere that disallows telnet from external. I tried uninstalling my antivirus (CA Etrust ITM 8.0), but still had the same result. I found one article that suggested disabling RAS on the sbs server, which I have done but to no avail. I do not have a windows firewall enabled. The fact that some email still comes through just doesnt make sense to me. I would have though it should not work at all if i cannot telnet the port.

I can telnet port 80 from external IP addresses.

Does anyone know if I am missing something obvious? Is there some kind of logging I can enable to trap attempted telnet sessions? Is there some kind of "traceroute" thing I should be using?

Any help or advice will be very much appreaciated.
Who is Participating?
doesnt sound like this has anything to do with exchange.  if you can have a full conversation with port 25 from on your lan then it must be the fw that is the problem.

"telnet to port 25" is pretty much what happens when an email gets delivered to a server, so there wouldnt be a rule to stop 'telnet to port 25".  as long as the port is open and the route exists it should work.  if you have a cisco pix have you set the smtp fixup?
jeremyuAuthor Commented:
Hi northcide

I have a cyberguard SG575... but as I said, there is two other servers behind it as well with the same rules, and they are fine. What you are saying makes sense, i will try recreating the rules on the firewall and see if that fixes it. Thanks for fixing my focus :)

will report back shortly
jeremyuAuthor Commented:
hmmmm, no luck. I have remade all rules relating to the server in question. I have tried disabling filter rules on the smtp Virtual server. I have rebooted everything I can between the machine and the internet. On the happy side of things, I did receive my notification from EE via email, so they seem to be able to talk to the server. Any other suggestions?
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

What results do you get with the dnsreport facility within  For example: Is there a backup mail server in place at your ISP which, by virtue of MX records setup,  is receiving some of the mail when your server is busy, and this is chucking the mail back to the recipient because it is not recognizing the domain that it is ultimately destined for?  (thinking that it is acting as an unauthorised relay and rejecting it for that reason).  If this were the case I would expect random acceptance/rejection from any given source - you are seeing consistent acceptance from one source and consistent rejection from another.
>chucking the mail back to the sender...
jeremyuAuthor Commented:
Hi moorhouselondon,

Results of dns stuff: I had two fails, one with the mail server, the other with A records-
1)     ERROR: I could not complete a connection to any of your mailservers! Timed out [Last data sent: RCPT TO: ]
         If this is a timeout problem, note that the DNSreport only waits about 40 seconds for responses,  
         so your mail *may* work fine in this case but you will need to use testing tools specifically
         designed for such situations to be certain.
2)    ERROR: I couldn't find any A records for But I did find a referral to (and
        maybe others). If you want a website at (as well as, you    
        will need an A record for If you do not want a website at,
         you can ignore this error.

40 seconds should be way long enough, i get immediate response from the server when on the LAN, or when hitting websites from external...

I have a website at the www addresss, it works fine. I did an nslookup on the name server, and it is definitely there. I don't host anything at the straight so i cannot see this being an issue.  While doing nslookup I checked the results for my mail. address and that all look fine as well.

Unfortunately I don't have a backup mail server at my ISP any more, they disabled the service without telling me. This is what has bought light to the issue. As far as I can tell all mail that cound not get directly to our server was going through our secondary mx. I know i can purchase an alternative secondary as a workaround, but I would really like to fugure out what the issue is here.

I might try changing its IP address and run the connection wizard again, then change all my firewall rules. Maybe something has gotten itself confused (Like me :) ).
This sounds like a DNS problem.   You need to look at the MX records for the domain and make sure (1) that there are no numerical IP addresses in there (2) the record that points to your ISP's backup server has been removed (3) that you have a reference  to an entry# in the A records  that, in turn, points to the IP address that you are routing mail in on your Router and (4) check that any other MX records listed in there (by the sound of it, there should be none), are there for a good reason.  I take it that you didn't have any error regarding CNAME's so I don't need to say anything about these.

You can check these things using  Scroll right down and on the right-hand column (Hostname Tools), top entry (DNS Tools), you can check these things.

# e.g., mail, but it could be anything you like, so long as there's a corresponding entry in the A records.
jeremyuAuthor Commented:
OK.... found the issue. It was a TarpitTime registry setting on the SMTP service. It was causing a timeout. Seems some email servers out there have timeouts set below what our tarpit setting was, and others do not. Splitting points each way since both of you added to my knowlege in the area. Thanks for your time.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.