Mails are being bounced back only to one client, SMTP Connector que

[marthymcfly]

Hello,

Lately we started to experience email issues when trying to contact specific customer, lets call it example.com. It does not matter if its example.co.uk, or .ro, .de etc it still would not send and move it to SMTP que and after some time we receive bounce back message.
We are running Exchange 2003 on SBS 2003 server. We have external domain for our company bonded to our Exchange server with POP3 connector. Our hosting company config says that that they are using 587 port for SMTP, not 25. I changed it in SMTP Protocol in Exchange Manager to 587. Also added rule on firewall for this port.
It looks like we have smart host set as well, so we have 2 virtual SMTP servers running.
I have no idea what is cause of this issue.
Can anyone advise?

Thanks
Marthymcfly

 

[ShackDaddy]

Can you post the whole bounceback message? The particular error code you get usually indicates the nature of the problem.

Dave Shackelford
ThirdTier.net

 

[marthymcfly]

Hello Dave,

Thanks for your answer, here is the bounce back message with the error code we receive.

Your message did not reach some or all of the intended recipients.
Subject: ...
Sent: 12/03/2014 08:53
The following recipient(s) cannot be reached:
... on 14/03/2014 09:04
The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator.
<####.COM #4.0.0 smtp;451 TLS/SSLv3 Connection required. (#4.7.1)>

 

[marthymcfly]

I also found this "

https://luxsci.com/extranet/tlschecker.html"

website and run few checks against our and problematic server.
That's the message I receive when running it against our server:

Results

Opportunistic TLS is supported by the inbound email servers for ######.com.

and that's what it says when I run against their server:

Results

A connection error occured when trying to comunicate with the inbound email servers for this ############.com.

Failed to connect to ###############.com

As we cannot currently connect to all of the inbound email servers for this domain, we cannot say for sure that opportunistic TLS is fully supported. It is possible that one or more of the DNS MX records for this domain are invalid.

Hope that helps...

 

[ShackDaddy]

It sounds like the target domain requires TLS for any inbound connection, and may also only use that domain for pre-arranged TLS partnerships. I think the easiest thing would be to contact them and find out what their requirements are. Every month I help someone set up an enforced TLS relationship, and there's usually always someone to contact at the other end if there are issues validating encryption or problems connecting.

Dave Shackelford
ThirdTier.net