Outbound mails fail with greylisting - no second attempt

Hi hagman_01 

Thank you for reaching out to the Community! 

From the UTM help page:

"Use greylisting: Greylisting basically means the temporary rejection of emails for a certain amount of time. Typically, a mail server using greylisting will record the following pieces of information for all incoming messages:

• The sender address
• The IP Closed address of the host the message is sent from
• The recipient address
• The message subject

This data set is checked against the SMTP proxy's internal database; if the data set has not been seen before, a record is created in the database along with a special timestamp describing it. This data set causes the email to be rejected for a period of five minutes. After that time the data set is known to the proxy and the message will be accepted when it is sent again. Note that the data set will expire after 30 days if it is not updated within this period.
Greylisting uses the fact that most senders of spam messages use software based on the "fire-and-forget" method: Try to deliver the mail and if it doesn’t work, forget it! This means that senders of spam mail do not try to send emails again when there is a temporary failure, contrary to Closed-conform mail servers. The assumption is that since temporary failures are built into the RFC specifications for email delivery, a legitimate server will try again to send the email later, at which time the destination will accept it."

Did the sender server try to retry sending the original email as it failed temporarily due to the greylisting configuration on your UTM?

Thanks,

Hi hagman_01 

Thank you for reaching out to the Community! 

From the UTM help page:

"Use greylisting: Greylisting basically means the temporary rejection of emails for a certain amount of time. Typically, a mail server using greylisting will record the following pieces of information for all incoming messages:

• The sender address
• The IP Closed address of the host the message is sent from
• The recipient address
• The message subject

This data set is checked against the SMTP proxy's internal database; if the data set has not been seen before, a record is created in the database along with a special timestamp describing it. This data set causes the email to be rejected for a period of five minutes. After that time the data set is known to the proxy and the message will be accepted when it is sent again. Note that the data set will expire after 30 days if it is not updated within this period.
Greylisting uses the fact that most senders of spam messages use software based on the "fire-and-forget" method: Try to deliver the mail and if it doesn’t work, forget it! This means that senders of spam mail do not try to send emails again when there is a temporary failure, contrary to Closed-conform mail servers. The assumption is that since temporary failures are built into the RFC specifications for email delivery, a legitimate server will try again to send the email later, at which time the destination will accept it."

Did the sender server try to retry sending the original email as it failed temporarily due to the greylisting configuration on your UTM?

Thanks,

Apparently I have to make a summary of my initial post if it was that unclear:

The problem is not about our Sophos UTM using greylisting against incoming mail.

The problem is about our Sophos UTM failing to deliver outboud mail when the receiving end uses greylisting.

Indeed, I expected that "a legitimate server will try again to send the email later," -- but Sophos UTM did exactly this NOT.

Within 10 seconds of the outbound mail being queued, Sophos UTM attempted delivery to the two MTAs of the remote side (which both resulted in a temporary error due to grelisting) and then immediately bounced the mail.

Observed behaviour: Mail bounced after one initial attempt per remote MX

Expected behaviour: Retry outbound delivery a few minutes later

Hello hagman_01,

Thank you for the clarification.

Yes the UTM should try to resend the email after 5 minutes, then try again and if it fails double the time and try again and so on until it reaches 5 days.

Would you mind sharing the SMTP logs via DM.

Regards,