KB Article | Forcepoint Support

Problem Description

Why is email not being delivered?

Resolution

Message transfer and disposition

The service deliberately uses the most straightforward and standard implementation possible for email delivery, to ensure that it does not cause unexpected delivery problems. Mail relays are maintained with ample disk space, network and server processing capacity is provided according to a defined capacity plan. The implementation is based on sendmail - the world's most widely-deployed Mail Transfer Agent (MTA) - and BIND, the world's most widely-deployed DNS server.

Message Center

To find out what has happened to an email, use the Message Center. If you cannot find any record of the message then either it has not been passed to Hosted Email Security, or less likely, there is some sort of delay on the arrival of processing data in the Message Center - in this case try the search again later. Alternatively, end users can use the End User Message Report (EUMR) to see their own messages.

Once you have found the message, click to see what happened to it - it will either have been
 
  • delivered;
  • quarantined;
  • redirected (perhaps via an alias);
  • non-delivered (a non-delivery notification should have been sent back to the sender);
  • queued and delivery will be retried later.

Occasionally - for example if different policies apply to the various recipient domains of a message - the service splits the message into several separate messages, each of which is processed separately.

Each intended recipient of the message has a delivery status shown in the log.

Message transfer logs

For a successful delivery you see a message like this:

Receiving system returned "Sent ( <1102110867.46104dbe7fdeebfcf3a4426075c99ace@quark.system.com> Queued mail for delivery)" status 2.0.0, "Successfully transferred"

The 2.0.0 code is a delivery status code and the leading "2" indicates it was successfully delivered. Unsuccessful delivery looks like this:

Receiving system returned "Deferred: Connection refused by quark.system.com." status 4.0.0, "Transient failure"

Codes with a leading "4" indicate a transient failure - a temporary failure that may eventually clear - which means that the sending system should retry delivery. In this case you will often see a large number of these as our service will retry the delivery attempt frequently.

Codes with a leading "5" indicate a permanent failure - which means that our service will normally return a non-delivery notification message.

Two excerpts from Internet RFC 1893 - the document defining delivery status codes - are below. You can access the full RFC text at http://www.faqs.org/rfcs/rfc1893.html.

Delivery Status Codes

RFC 1893, Section 2


The class sub-code provides a broad classification of the status. The enumerated values in the class are defined as:

2.X.X Success

Success specifies that the DSN is reporting a positive delivery action. Detail sub-codes may provide notification of transformations required for delivery.

4.X.X Persistent Transient Failure

A persistent transient failure is one in which the message as sent is valid, but some temporary event prevents the successful sending of the message. Sending in the future may be successful.

5.X.X Permanent Failure

A permanent failure is one which is not likely to be resolved by resending the message in the current form. Some change to the message or the destination must be made for successful delivery.

RFC 1893, Section 8

The subject sub-code classifies the status. This value applies to each of the three classifications. The subject sub-code, if recognized, must be reported even if the additional detail provided by the detail sub-code is not recognized. The enumerated values for the subject sub-code are:

X.1.0 Other address status

X.1.1 Bad destination mailbox address

X.1.2 Bad destination system address

X.1.3 Bad destination mailbox address syntax

X.1.4 Destination mailbox address ambiguous

X.1.5 Destination mailbox address valid

X.1.6 Mailbox has moved

X.1.7 Bad sender's mailbox address syntax

X.1.8 Bad sender's system address

X.2.0 Other or undefined mailbox status

X.2.1 Mailbox disabled, not accepting messages

X.2.2 Mailbox full

X.2.3 Message length exceeds administrative limit.

X.2.4 Mailing list expansion problem

X.3.0 Other or undefined mail system status

X.3.1 Mail system full

X.3.2 System not accepting network messages

X.3.3 System not capable of selected features

X.3.4 Message too big for system

X.4.0 Other or undefined network or routing status

X.4.1 No answer from host

X.4.2 Bad connection

X.4.3 Routing server failure

X.4.4 Unable to route

X.4.5 Network congestion

X.4.6 Routing loop detected

X.4.7 Delivery time expired

X.5.0 Other or undefined protocol status

X.5.1 Invalid command

X.5.2 Syntax error

X.5.3 Too many recipients

X.5.4 Invalid command arguments

X.5.5 Wrong protocol version

X.6.0 Other or undefined media error

X.6.1 Media not supported

X.6.2 Conversion required and prohibited

X.6.3 Conversion required but not supported

X.6.4 Conversion with loss performed

X.6.5 Conversion failed

X.7.0 Other or undefined security status

X.7.1 Delivery not authorized, message refused

X.7.2 Mailing list expansion prohibited

X.7.3 Security conversion required but not possible

X.7.4 Security features not supported

X.7.5 Cryptographic failure

X.7.6 Cryptographic algorithm not supported

X.7.7 Message integrity failure

SMTP Reply Codes

This is the full list of SMTP reply codes specified in the RFCs or in extensive use.

Numerical Order

 

CodeMeaning
200(nonstandard success response, see rfc876)
211System status, or system help reply
214Help message
220< domain > Service ready
221< domain > Service closing transmission channel
250Requested mail action okay, completed
251User not local; will forward to
354Start mail input; end with .
421< domain > Service not available, closing transmission channel
450Requested mail action not taken: mailbox unavailable
451Requested action aborted: local error in processing
452Requested action not taken: insufficient system storage
500Syntax error, command unrecognized
501Syntax error in parameters or arguments
502Command not implemented
503Bad sequence of commands
504Command parameter not implemented
521< domain > does not accept mail (see rfc1846)
530Access denied
550Requested action not taken: mailbox unavailable
551User not local; please try
552Requested mail action aborted: exceeded storage allocation
553Requested action not taken: mailbox name not allowed
554Transaction failed


Group Command
 
Command Code Description
connect  
 220< domain >Service ready
 421< domain >Service not available, closing transmission channel
HELO  
 250Requested mail action okay, completed
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 504Command parameter not implemented
 521< domain >does not accept mail [rfc1846]
 421< domain >Service not available, closing transmission channel
EHLO  
 250Requested mail action okay, completed
 550Not implemented
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 504Command parameter not implemented
 421< domain >Service not available, closing transmission channel
MAIL  
 250Requested mail action okay, completed
 552Requested mail action aborted: exceeded storage allocation
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 421< domain >Service not available, closing transmission channel
RCPT  
 250Requested mail action okay, completed
 251User not local; will forward to
 550Requested action not taken: mailbox unavailable
 551User not local; please try
 552Requested mail action aborted: exceeded storage allocation
 553Requested action not taken: mailbox name not allowed
 450Requested mail action not taken: mailbox unavailable
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 503Bad sequence of commands
 521< domain >does not accept mail [rfc1846]
 421< domain >Service not available, closing transmission channel
DATA  
 354Start mail input; end with .
 451Requested action aborted: local error in processing
 554Transaction failed
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 503Bad sequence of commands
 421< domain >Service not available, closing transmission channel
received data  
 250Requested mail action okay, completed
 552Requested mail action aborted: exceeded storage allocation
 554Transaction failed
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
RSET  
 200(nonstandard success response, see rfc876)
 250Requested mail action okay, completed
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 504Command parameter not implemented
 421< domain >Service not available, closing transmission channel
SEND  
 250Requested mail action okay, completed
 552Requested mail action aborted: exceeded storage allocation
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 421< domain >Service not available, closing transmission channel
SOML  
 250Requested mail action okay, completed
 552Requested mail action aborted: exceeded storage allocation
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 421< domain >Service not available, closing transmission channel
SAML  
 250Requested mail action okay, completed
 552Requested mail action aborted: exceeded storage allocation
 451Requested action aborted: local error in processing
 452Requested action not taken: insufficient system storage
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 421< domain >Service not available, closing transmission channel
VRFY  
 250Requested mail action okay, completed
 251User not local; will forward to
 550Requested action not taken: mailbox unavailable
 551User not local; please try
 553Requested action not taken: mailbox name not allowed
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 504Command parameter not implemented
 421< domain >Service not available, closing transmission channel
EXPN  
 250Requested mail action okay, completed
 550Requested action not taken: mailbox unavailable
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 504Command parameter not implemented
 421< domain >Service not available, closing transmission channel
HELP  
 211System status, or system help reply
 214Help message
 500Syntax error, command unrecognized
 501Syntax error in parameters or arguments
 502Command not implemented
 504Command parameter not implemented
 421< domain >Service not available, closing transmission channel
NOOP  
 200(nonstandard success response, see rfc876)
 250Requested mail action okay, completed
 500Syntax error, command unrecognized
 421< domain >Service not available, closing transmission channel
QUIT  
 221< domain >Service closing transmission channel
 500Syntax error, command unrecognized
TURN  
 250Requested mail action okay, completed
 502Command not implemented
 500Syntax error, command unrecognized
 503Bad sequence of commands





Keywords: email blocking; phishing and spam mail; emails stuck; no email; cloud email issue; smtp connection issue

Article Feedback



Thank you for the feedback and comments.