This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP relay not allowing anything in

First of all the error:

554 554 5.7.1 : Relay access denied (state 14).

The above is the error I get when trying to send externally to an internal address. (for example from gmail to a company address)

I've configured all the domains we use as well as set a static host list and pointed it to our exchange server at 192.168.0.1.

Is there any setting that might cause this to occur?

I had this occur on me whilst doing a live test today (end of day when everyone has gone home, plugged in the astaro 220 got everything working but incoming email.. obviously moved it back to the old firewall)

I'll do some further tests at work tomorrow (obviously), but any suggestions on where I might be going wrong are more than welcome.

This thread was automatically locked due to age.

0 BAlfson over 17 years ago

Do you use an upstream host? (Relaying tab)

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 markcasey over 17 years ago in reply to BAlfson

Do you use an upstream host? (Relaying tab)

Cheers - Bob

No, direct. For example an email received from gmail comes straight through:

Microsoft Mail Internet Headers Version 2.0
Received: from mail-gx0-f16.google.com ([192.168.0.254]) by mailgate.abc.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 14 Oct 2008 18:44:14 +0100
Received: from mail-gx0-f16.google.com (209.85.217.16)

I just decided to do some images of the settings themselves, I do not see anything wrong here. (linked instead of images on the page since they're vertically large)

Global
Routing
Anti-Virus
Anti-Spam
Exceptions
Relaying
Advanced
Cancel
Vote Up 0 Vote Down

Cancel
0 tom_01 over 17 years ago

554 554 5.7.1 : Relay access denied (state 14).

ASG does not produce such messages. Are you sure all the incoming mail arrives on the ASG?

What is the real domain used? Please do not obsfucate.
Cancel
Vote Up 0 Vote Down

Cancel
0 markcasey over 17 years ago in reply to tom_01

ASG does not produce such messages. Are you sure all the incoming mail arrives on the ASG?

What is the real domain used? Please do not obsfucate.

That was from the email client headers. Well, the 554 bit was from the email error on gmail, the other bit was from the email headers.

The real domain used is jadeprint.com as shown in the images.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 17 years ago in reply to tom_01

Mark, I'm confused: does email get rejected with a "554 5.7.1" message, or does it come "straight though"?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 markcasey over 17 years ago in reply to BAlfson

Mark, I'm confused: does email get rejected with a "554 5.7.1" message, or does it come "straight though"?

Cheers - Bob

Do you mean is it giving the error to the sender but still being received by the recipient? In which case no, it's giving the sender the error and the recipient is getting nothing.

I did a different test last night as well, this is from another email provider in its entirety. (true email address changed to avoid spam harvesters)


--ApZbf.4MJbZusrh.1wQDdh.YPHSVr

content-type: text/plain;

    charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



The following message to  was undeliverable.

The reason for the problem:

5.1.0 - Unknown address error 554-'5.7.1 : Relay =

access denied'



--ApZbf.4MJbZusrh.1wQDdh.YPHSVr

content-type: message/delivery-status



Reporting-MTA: dns; mk-outboundfilter-3.mail.uk.tiscali.com



Final-Recipient: rfc822;abc@jadeprint.com

Action: failed

Status: 5.0.0 (permanent failure)

Remote-MTA: dns; [194.217.242.9]

Diagnostic-Code: smtp; 5.1.0 - Unknown address error 554-'5.7.1 : Relay access denied' (delivery attempts: 0)



--ApZbf.4MJbZusrh.1wQDdh.YPHSVr

content-type: message/rfc822



Received: from mk-nildram-webmail-1.uk.tiscali.com (HELO UebiMiau) ([212.139.135.3])

  by smtp.f2s.tiscali.co.uk with SMTP; 14 Oct 2008 17:48:48 +0100

Received: from mk-nildram-webmail-1.uk.tiscali.com (HELO UebiMiau) ([212.139.135.3])

  by smtp.f2s.tiscali.co.uk with SMTP; 14 Oct 2008 17:48:48 +0100

Received: from client 62.49.116.50 for UebiMiau2.7 (webmail client); Tue, 14 Oct 2008 17:48:47 +0100

Date: Tue, 14 Oct 2008 17:48:47 +0100

From: "abc" 

X-Webmail-User: 43454b3b3b4235566479547221654e4a4b7e652054

To: abc@jadeprint.com

Reply-to: "abc" 

Subject: test

X-Priority: 3

X-Mailer: UebiMiau 2.7.2

X-Original-IP: 62.49.116.50

Content-Transfer-Encoding: 8bit

Return-Path: abc@gotadsl.co.uk

X-MSMail-Priority: Medium

Importance: Medium

Content-Type: text/plain; charset="iso-8859-1";

MIME-Version: 1.0



test



________________________________________________

Message sent using UebiMiau 2.7.2





--ApZbf.4MJbZusrh.1wQDdh.YPHSVr--

I've just installed astaro in vmware workstation, so I've started experimenting without the fear of breaking the 220 demo hardware.

I'm approaching this slightly different as to how it was recommended to me, using the wizard this time.

0 BAlfson over 17 years ago in reply to markcasey

Mark,

Check that your reverse DNS record is correct. As an experiment, what happes if you uncheck BATV?

And, I still don't understand how you received an email from your gmail account if email from gmail is rejected...

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 17 years ago in reply to BAlfson

Looks like you have 3 entries for mx records. From the IP provided in your mail headers, the denying mta is at 194.217.242.9 (your second mx relay-1.mail.demon.net). This is the relay that is denying your mail not astaro.

All your mail should be going to the first mx but its not so your astaro is not live on the net for some reason if that is your first mx.

HTH[:D]
Cancel
Vote Up 0 Vote Down

Cancel
0 markcasey over 17 years ago in reply to BAlfson

Mark,

Check that your reverse DNS record is correct. As an experiment, what happes if you uncheck BATV?

And, I still don't understand how you received an email from your gmail account if email from gmail is rejected...

Cheers - Bob

I didn't receive any email from gmail, just the 554 gmail generated error.

Apologies as I'm typing this up on my iPhone, so sorry for the short reply.

As to other mx's if it was being rejected a that point then surely it wouldn't work with our current firewall?

Also, I've had the thought that incoming emails come to 62.49.116.52 whilst the firewalls ip is 62.49.116.50, however we've got a netmask of 255.255.255.248 so it shouldn't matter. Right?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 17 years ago in reply to markcasey

Billybob's got it right. Your Astaro isn't receiving emails. It's only telling the world that x.x.x.50 is available, so your emails are going to your second mx.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel