4.4.7 smtp error

Hi!

I have a email server running almost perfect, just got this issue with a few
costumers trying to send email to me. They get the nds 4.4.7. One of them are
sending from smtp.varberg.se.

I wonder if someone new if I am on the right track when I look at the
reverse dns for my mailserver? Or can it be the ttl time to answer.

My domain is
bandersson-akeri.se

Would be happy if someone could give me some ideas on this one.

Regards
Surfer

"Brian Cryer" <not.here@localhost> wrote in message
news:...
> "Surfer" <> wrote in message
> news:9EC28E83-6AA1-464D-8377-...
>> Hi!
>>
>> I have a email server running almost perfect, just got this issue with a
>> few
>> costumers trying to send email to me. They get the nds 4.4.7. One of them
>> are
>> sending from smtp.varberg.se.
>>
>> I wonder if someone new if I am on the right track when I look at the
>> reverse dns for my mailserver? Or can it be the ttl time to answer.
>>
>> My domain is
>> bandersson-akeri.se
>>
>> Would be happy if someone could give me some ideas on this one.
>
> This might not be the cause of the problem, but certainly something to
> double check:
>
> You have two mx records:
> MX preference = 5, mail exchanger = mail.bandersson-akeri.se
> MX preference = 10, mail exchanger = bandersson-akeri.no-ip.org
>
> So most mail should be directed to mailbandersson-akeri.se. However if for
> any reason that server isn't contactable (and this could be something
> local-ish to the sender) then emails will be delivered to
> bandersson-akeri.no-ip.org.
>
> At the time of writing there is no SMTP server listening on
> bandersson-akeri.no-ip.org, nor can I ping it which suggests that its
> off-line. Given that this is a no-ip.org name, implies to me that its not
> on a fixed ip and that its therefore either a (domestic) pc which is
> currently off or a laptop used for travel purposes. My guess would be that
> there are times which this is on, that it does have an SMTP server on it
> and its that SMTP server which is rejecting emails and generating the NDRs
> that you are seeing. This would be consistent with it only affecting a few
> customers since most SMTP traffic would go to mail.bandersson-akeri.se and
> only a minority to your bandersson-akeri.no-ip.org one from where it is
> being rejected. It wouldn't matter if no SMTP server were listening on
> bandersson-akeri.no-ip.org as the sender would just try again later. If
> the IP address for bandersson-akeri.no-ip.org were freed and re-used by
> the ISP and given to another customer who also happened to thave an SMTP
> server then that would be another reason why it would be rejected. So I'd
> suggest that you (i.) check the configuration on the SMTP server running
> on your no-ip address and (ii.) consider dropping the no-ip one.
>
> Without knowing more about the details of who the email was sent to and
> the full nds message, that's about the best I can do.
>
> HTH.
> --
> Brian Cryer
> www.cryer.co.uk/brian
>


Brian,

Actually, I just telnetted to mail.bandersson-akeri.se, and it responds, so
that guy is active, however I agree, bandersson-akeri.no-ip.org does not
respond with telnet and is either down, not configured, or the IP is
incorrect.

I believe the MX entry for bandersson-akeri.no-ip.com is incorrect, because
I believe it is a domain FQDN and not a hostname.

Just an FYI, ping is not the best diagnostic tool. Many installations block
ICMP at the edge firewall.

For Surfer:

I notice there is no SPF record for bandersson-akeri.se. I would say that
would be one important record to configure. That must be done at the public
nameserver hosting company, which appears to be at no-ip.com.

Here is more info on the 4.4.7 error:

Delivery status notifications in Exchange Server and in Small ...Numeric
Code: 4.4.7. Possible Cause: The message in the queue has expired. .... (For
example, if a Hotmail account is no longer active, a 550 SMTP error ...
http://support.microsoft.com/kb/284204

As far as:
>> I wonder if someone new if I am on the right track when I look at the
>> reverse dns for my mailserver? Or can it be the ttl time to answer.

The reverse entry for is:

> 194.236.110.42
Name: 194-236-110-42.customer.telia.com
Address: 194.236.110.42

So that doesn't match your mail server name, but that's ok, many are
configured that way. You at least do have a reverse entry, what many spam
filters look for.

What did you set your TTL for, and where did you set that? Normally an MTA
will try to send an email to a receiving MTA, and if there are any issues on
the receiving side, the sending MTA will hold it in the queue and go into a
retry state. If it still cannot be sent after 12 hours, the sender gets a
'delivery delayed' notification. If it cannot be sent after 2 days, the
sender will get an NDR, in this case, they are getting the failure that it
expired in the queue. This could be caused by an issue on your end with your
receiving server that if your line goes down and your mail server doesn't
respond, the sending server is going back and trying to use the secondary MX
entry, and since that guy doesn't even respond, it sits at the sender's MTA
until it expires.


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

Hi Surfer,

Thanks for your post and Brian & Ace's input.

Just in addition, you may also try Exchange Server Remote Connectivity Analyzer Tool(ExRCA) to test the inbound mail flow. Just now, I tested it with domain name
"bandersson-akeri.se" and got the error "A network error occurred while communicating with remote host
Exception Details:
Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected
host has failed to respond 69.65.19.125:25 "

Connection failures of this type are commonly caused by the following:
" The server is down.
" The specified port is not listening for TCP connections.
" A firewall, proxy server, or hardware device is blocking the connection to your server.
" The network is congested.

Please try the ExRCA tool yourself for a simple test:

Using the Exchange Server Remote Connectivity Analyzer Tool (Part 2)
<http://www.msexchange.org/articles_tutorials/exchange-server-2007/tools/exchange-server-remote-connectivity-analyzer-tool-part2.html>

Here is the tool:
<https://www.testexchangeconnectivity.com/Default.aspx>

BTW, as Ace indicated, generally speaking, a 4.4.7 NDR is most commonly caused by the following reason:

A message in the queue has expired. The sending server tried to deliver the message, but the action was not completed in its message expiry timeframe.

A 4.4.7 NDR message usually indicates a problem on the receiving server. Check the validity of the recipient's address, as well as whether the receiving server is
configured to receive messages correctly. If you then resend the message, it is placed in the queue again, and if the receiving server is up, the message is delivered.

A 4.4.7 NDR message can also indicate that a message header limit has been reached on a remote server or that some other protocol timeout has occurred while
communicating with the remote server. It may be necessary to reduce the number of recipients in the header of the message for the host to which you are receiving this error.
If you then resend the message, it is placed in the queue again, and if the receiving server is up, the message is delivered.

Hope this helps.



Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

================================================== ================
Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
https://connect.microsoft.com/sbs08/...i/default.aspx

Please post your EBS related questions to the EBS newsgroup on Connect website:
https://connect.microsoft.com/ebs08/...i/default.aspx

If you want to use a newsreader other than a web forum to access these newsgroups,
please refer to the following blog to apply NNTP password and configure a newsreader:
http://msmvps.com/blogs/bradley/arch...ewsgroups.aspx
================================================== ================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ================
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ================

"Ace Fekay [MCT]" <> wrote in message
news:%23m%...
> "Brian Cryer" <not.here@localhost> wrote in message
> news:...
>> "Surfer" <> wrote in message
>> news:9EC28E83-6AA1-464D-8377-...
>>> Hi!
>>>
>>> I have a email server running almost perfect, just got this issue with a
>>> few
>>> costumers trying to send email to me. They get the nds 4.4.7. One of
>>> them are
>>> sending from smtp.varberg.se.
>>>
>>> I wonder if someone new if I am on the right track when I look at the
>>> reverse dns for my mailserver? Or can it be the ttl time to answer.
>>>
>>> My domain is
>>> bandersson-akeri.se
>>>
>>> Would be happy if someone could give me some ideas on this one.
>>
>> This might not be the cause of the problem, but certainly something to
>> double check:
>>
>> You have two mx records:
>> MX preference = 5, mail exchanger = mail.bandersson-akeri.se
>> MX preference = 10, mail exchanger = bandersson-akeri.no-ip.org
>>
>> So most mail should be directed to mailbandersson-akeri.se. However if
>> for any reason that server isn't contactable (and this could be something
>> local-ish to the sender) then emails will be delivered to
>> bandersson-akeri.no-ip.org.
>>
>> At the time of writing there is no SMTP server listening on
>> bandersson-akeri.no-ip.org, nor can I ping it which suggests that its
>> off-line. Given that this is a no-ip.org name, implies to me that its not
>> on a fixed ip and that its therefore either a (domestic) pc which is
>> currently off or a laptop used for travel purposes. My guess would be
>> that there are times which this is on, that it does have an SMTP server
>> on it and its that SMTP server which is rejecting emails and generating
>> the NDRs that you are seeing. This would be consistent with it only
>> affecting a few customers since most SMTP traffic would go to
>> mail.bandersson-akeri.se and only a minority to your
>> bandersson-akeri.no-ip.org one from where it is being rejected. It
>> wouldn't matter if no SMTP server were listening on
>> bandersson-akeri.no-ip.org as the sender would just try again later. If
>> the IP address for bandersson-akeri.no-ip.org were freed and re-used by
>> the ISP and given to another customer who also happened to thave an SMTP
>> server then that would be another reason why it would be rejected. So I'd
>> suggest that you (i.) check the configuration on the SMTP server running
>> on your no-ip address and (ii.) consider dropping the no-ip one.
>>
>> Without knowing more about the details of who the email was sent to and
>> the full nds message, that's about the best I can do.
>>
>> HTH.
>> --
>> Brian Cryer
>> www.cryer.co.uk/brian
>>
>
>
> Brian,
>
> Actually, I just telnetted to mail.bandersson-akeri.se, and it responds,
> so that guy is active, however I agree, bandersson-akeri.no-ip.org does
> not respond with telnet and is either down, not configured, or the IP is
> incorrect.

Sorry, it was the bandersson-akeri.no-ip.org that I couldn't connect to. I
agree that mail.bandersson-akeri.se is live.

> I believe the MX entry for bandersson-akeri.no-ip.com is incorrect,
> because I believe it is a domain FQDN and not a hostname.

Not sure on that. Whilst I agree that bandersson-akeri.no-ip.com is possibly
the problem. bandersson-akeri.no-ip.com is just as valid as
mail.bandersson-akeri.se.

> Just an FYI, ping is not the best diagnostic tool. Many installations
> block ICMP at the edge firewall.

Agreed (shame though as ping is so useful). I did mention that there wasn't
an SMTP server listening, as I checked both (icmp-ping and port 25).

I typically use cryping rather than ping because it lets me check an
individual port - not a true ping in that sense, but it does try to open a
connection on a port and reports back (in the same style as ping) whether it
could make a connection. Useful free tool.

<snip>

> What did you set your TTL for, and where did you set that? Normally an MTA
> will try to send an email to a receiving MTA, and if there are any issues
> on the receiving side, the sending MTA will hold it in the queue and go
> into a retry state. If it still cannot be sent after 12 hours, the sender
> gets a 'delivery delayed' notification. If it cannot be sent after 2 days,
> the sender will get an NDR, in this case, they are getting the failure
> that it expired in the queue. This could be caused by an issue on your end
> with your receiving server that if your line goes down and your mail
> server doesn't respond, the sending server is going back and trying to use
> the secondary MX entry, and since that guy doesn't even respond, it sits
> at the sender's MTA until it expires.

But that would be configuration on the sender's server, and the OP wouldn't
have any control over that. It might still be a factor, but is outside the
control of the OP.
--
Brian Cryer
www.cryer.co.uk/brian

"Brian Cryer" <not.here@localhost> wrote in message
news:%...
>>
>>
>> Brian,
>>
>> Actually, I just telnetted to mail.bandersson-akeri.se, and it responds,
>> so that guy is active, however I agree, bandersson-akeri.no-ip.org does
>> not respond with telnet and is either down, not configured, or the IP is
>> incorrect.
>
> Sorry, it was the bandersson-akeri.no-ip.org that I couldn't connect to. I
> agree that mail.bandersson-akeri.se is live.

Ok, I figured it was a typo. :-)


>> I believe the MX entry for bandersson-akeri.no-ip.com is incorrect,
>> because I believe it is a domain FQDN and not a hostname.
>
> Not sure on that. Whilst I agree that bandersson-akeri.no-ip.com is
> possibly the problem. bandersson-akeri.no-ip.com is just as valid as
> mail.bandersson-akeri.se.

Yes, for the most part, I agree, as well. However, in some cases, some
entities may use sub-domains for email systems, and what I was assuming,
since no-ip hosts multiple customers, they assign the customer name to it,
such as the "bandersson-akeri" as a sub-domain, therefore I was looking for
a host entry on top of that. Make sense?


>> Just an FYI, ping is not the best diagnostic tool. Many installations
>> block ICMP at the edge firewall.
>
> Agreed (shame though as ping is so useful). I did mention that there
> wasn't an SMTP server listening, as I checked both (icmp-ping and port
> 25).
>
> I typically use cryping rather than ping because it lets me check an
> individual port - not a true ping in that sense, but it does try to open a
> connection on a port and reports back (in the same style as ping) whether
> it could make a connection. Useful free tool.

Is that your own tool? I haven't heard of it until now. I will check into
it. Thanks for the heads-up!


>
> <snip>
>
>> What did you set your TTL for, and where did you set that? Normally an
>> MTA will try to send an email to a receiving MTA, and if there are any
>> issues on the receiving side, the sending MTA will hold it in the queue
>> and go into a retry state. If it still cannot be sent after 12 hours, the
>> sender gets a 'delivery delayed' notification. If it cannot be sent after
>> 2 days, the sender will get an NDR, in this case, they are getting the
>> failure that it expired in the queue. This could be caused by an issue on
>> your end with your receiving server that if your line goes down and your
>> mail server doesn't respond, the sending server is going back and trying
>> to use the secondary MX entry, and since that guy doesn't even respond,
>> it sits at the sender's MTA until it expires.
>
> But that would be configuration on the sender's server, and the OP
> wouldn't have any control over that. It might still be a factor, but is
> outside the control of the OP.

I agree. If the first priority MX doesn't respond, which I assume there is a
possible network issue at the OP's location, then the sending MTA will
choose the next MX priority record. So if the no-ip is the next one, and
doesn't respond, then it will sit in the sender's MTA queue. Not much the OP
can do about that, other than contact no-ip to see what's going on at their
end or correct the record.

> --
> Brian Cryer
> www.cryer.co.uk/brian
>
>

Ace

"Brian Cryer" <not.here@localhost> wrote in message
news:...
> "Ace Fekay [MCT]" <> wrote in message
> news:...
>> "Brian Cryer" <not.here@localhost> wrote in message
>> news:%...
>>>>
>>>> Brian,
>>>>
>>>> Actually, I just telnetted to mail.bandersson-akeri.se, and it
>>>> responds, so that guy is active, however I agree,
>>>> bandersson-akeri.no-ip.org does not respond with telnet and is either
>>>> down, not configured, or the IP is incorrect.
>>>
>>> Sorry, it was the bandersson-akeri.no-ip.org that I couldn't connect to.
>>> I agree that mail.bandersson-akeri.se is live.
>>
>> Ok, I figured it was a typo. :-)
>>
>>>> I believe the MX entry for bandersson-akeri.no-ip.com is incorrect,
>>>> because I believe it is a domain FQDN and not a hostname.
>>>
>>> Not sure on that. Whilst I agree that bandersson-akeri.no-ip.com is
>>> possibly the problem. bandersson-akeri.no-ip.com is just as valid as
>>> mail.bandersson-akeri.se.
>>
>> Yes, for the most part, I agree, as well. However, in some cases, some
>> entities may use sub-domains for email systems, and what I was assuming,
>> since no-ip hosts multiple customers, they assign the customer name to
>> it, such as the "bandersson-akeri" as a sub-domain, therefore I was
>> looking for a host entry on top of that. Make sense?
>
> Okay, I see what you mean.
>
>>>> Just an FYI, ping is not the best diagnostic tool. Many installations
>>>> block ICMP at the edge firewall.
>>>
>>> Agreed (shame though as ping is so useful). I did mention that there
>>> wasn't an SMTP server listening, as I checked both (icmp-ping and port
>>> 25).
>>>
>>> I typically use cryping rather than ping because it lets me check an
>>> individual port - not a true ping in that sense, but it does try to open
>>> a connection on a port and reports back (in the same style as ping)
>>> whether it could make a connection. Useful free tool.
>>
>> Is that your own tool? I haven't heard of it until now. I will check into
>> it. Thanks for the heads-up!
>
> Er, yes, guilty as charged. I use the command line ping quite frequently
> and by writing my own I could extend it in ways I wanted - such as being
> able to test other protocols or ports from the command line.
> --
> Brian Cryer
> www.cryer.co.uk/brian
>
>



Guilty! LOL! I'll have to try it a few times and check it out. Thanks!

Ace