Exchange 2003 - cannot telnet port 25 from external IP address.

Posted on 2007-08-10
Last Modified: 2013-11-05
I am having an issue with my Exchange 2003. It is on an SBS 2003 server SP1. All other services appear to be functioning fine.
The server receives email from some servers (eg hotmail comes through fine), fails with some others (I cannot receive confirmation mails from facebook), and it sends mail without isssue as well. When I run diagnostics on I get the following:

Banner: Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at Fri, 10 Aug 2007 23:11:48 +1000 [234 ms]  
Connect Time: 0.234 seconds - Good
Transaction Time: 11 seconds - Not good!
Relay Check: OK - This server is not an open relay.
Rev DNS Check: OK - x.x.x.x resolves to
GeoCode Info: Geocoding server is unavailable
Session Transcript: TIMEOUT after HELO - DIAGNOSTIC TEST - See -- 10.531 seconds

The whole conversation part that is usually in the "Session Transcript" just seems to be non-existant.

I can telnet to the servers port 25 when on the LAN and get a response to a HELO.

There are two other seperate exchange servers, is seperate domains behind my firewall, which have the exact same rules on the firewall and both return "good" results from mxtoolbox with a transaction time generally around 2 seconds.

I have been going insane tring to fin if there is some rule located somewhere that disallows telnet from external. I tried uninstalling my antivirus (CA Etrust ITM 8.0), but still had the same result. I found one article that suggested disabling RAS on the sbs server, which I have done but to no avail. I do not have a windows firewall enabled. The fact that some email still comes through just doesnt make sense to me. I would have though it should not work at all if i cannot telnet the port.

I can telnet port 80 from external IP addresses.

Does anyone know if I am missing something obvious? Is there some kind of logging I can enable to trap attempted telnet sessions? Is there some kind of "traceroute" thing I should be using?

Any help or advice will be very much appreaciated.
Question by:jeremyu
    LVL 7

    Accepted Solution

    doesnt sound like this has anything to do with exchange.  if you can have a full conversation with port 25 from on your lan then it must be the fw that is the problem.

    "telnet to port 25" is pretty much what happens when an email gets delivered to a server, so there wouldnt be a rule to stop 'telnet to port 25".  as long as the port is open and the route exists it should work.  if you have a cisco pix have you set the smtp fixup?

    Author Comment

    Hi northcide

    I have a cyberguard SG575... but as I said, there is two other servers behind it as well with the same rules, and they are fine. What you are saying makes sense, i will try recreating the rules on the firewall and see if that fixes it. Thanks for fixing my focus :)

    will report back shortly

    Author Comment

    hmmmm, no luck. I have remade all rules relating to the server in question. I have tried disabling filter rules on the smtp Virtual server. I have rebooted everything I can between the machine and the internet. On the happy side of things, I did receive my notification from EE via email, so they seem to be able to talk to the server. Any other suggestions?
    LVL 31

    Expert Comment

    What results do you get with the dnsreport facility within  For example: Is there a backup mail server in place at your ISP which, by virtue of MX records setup,  is receiving some of the mail when your server is busy, and this is chucking the mail back to the recipient because it is not recognizing the domain that it is ultimately destined for?  (thinking that it is acting as an unauthorised relay and rejecting it for that reason).  If this were the case I would expect random acceptance/rejection from any given source - you are seeing consistent acceptance from one source and consistent rejection from another.
    LVL 31

    Expert Comment

    >chucking the mail back to the sender...

    Author Comment

    Hi moorhouselondon,

    Results of dns stuff: I had two fails, one with the mail server, the other with A records-
    1)     ERROR: I could not complete a connection to any of your mailservers!
    Timed out [Last data sent: RCPT TO: ]
             If this is a timeout problem, note that the DNSreport only waits about 40 seconds for responses,  
             so your mail *may* work fine in this case but you will need to use testing tools specifically
             designed for such situations to be certain.
    2)    ERROR: I couldn't find any A records for But I did find a referral to (and
            maybe others). If you want a website at (as well as, you    
            will need an A record for If you do not want a website at,
             you can ignore this error.

    40 seconds should be way long enough, i get immediate response from the server when on the LAN, or when hitting websites from external...

    I have a website at the www addresss, it works fine. I did an nslookup on the name server, and it is definitely there. I don't host anything at the straight so i cannot see this being an issue.  While doing nslookup I checked the results for my mail. address and that all look fine as well.

    Unfortunately I don't have a backup mail server at my ISP any more, they disabled the service without telling me. This is what has bought light to the issue. As far as I can tell all mail that cound not get directly to our server was going through our secondary mx. I know i can purchase an alternative secondary as a workaround, but I would really like to fugure out what the issue is here.

    I might try changing its IP address and run the connection wizard again, then change all my firewall rules. Maybe something has gotten itself confused (Like me :) ).
    LVL 31

    Assisted Solution

    This sounds like a DNS problem.   You need to look at the MX records for the domain and make sure (1) that there are no numerical IP addresses in there (2) the record that points to your ISP's backup server has been removed (3) that you have a reference  to an entry# in the A records  that, in turn, points to the IP address that you are routing mail in on your Router and (4) check that any other MX records listed in there (by the sound of it, there should be none), are there for a good reason.  I take it that you didn't have any error regarding CNAME's so I don't need to say anything about these.

    You can check these things using  Scroll right down and on the right-hand column (Hostname Tools), top entry (DNS Tools), you can check these things.

    # e.g., mail, but it could be anything you like, so long as there's a corresponding entry in the A records.

    Author Comment

    OK.... found the issue. It was a TarpitTime registry setting on the SMTP service. It was causing a timeout. Seems some email servers out there have timeouts set below what our tarpit setting was, and others do not. Splitting points each way since both of you added to my knowlege in the area. Thanks for your time.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    Learn more about how the humble email signature can be used as more than just an electronic business card. When used correctly, a signature can easily be tailored for different purposes by different departments within an organization.
    Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
    In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
    The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now