Message delivery from Messaging Gateway rejected with SMTP Code: "554 5.7.1"

Products

• Messaging Gateway

Issue/Introduction

Symantec Messaging Gateway does not deliver to one or more external domains, and the Message Audit Log (MAL) shows a final delivery status with the "554 5.7.1" code.

Cause

SMTP code "554 5.7.1" is a rejection from the receiving mail server and means email delivery is 'Not allowed' and that redelivery should not be attempted. A 5xx level status code indicates a "terminal" status and SMG will not attempt to redeliver the message. 

Resolution

The "554 5.7.1" SMTP status code generally includes information on the cause of the rejection:

• 554 5.7.1 You are not allowed to connect
• 554 5.7.1 Rejected message by MTA, EHLO domain does not exist in DNS
• 554 5.7.1 This message has been blocked because it contains a banned word
• 554 5.7.1 Rejected message by MTA, RDNS record for connecting IP has no matching 'A' or 'MX' records
• 554 5.7.1 Delivery not authorized
• 554 5.7.1 <sender address>: Relay access denied
• 554 5.7.1 Bad senders system address

General Recommendations

• See Deployment best practices for Messaging Gateway for configuring both inbound and outbound traffic.
• Ensure that Messaging Gateway is scanning outbound messages for spam, and that spam filters are updated.
• Configure sender authentication features for outbound mail including SPF, DKIM signing, and DMARC
• Ensure that your internal network is not compromised by making sure that local antivirus is installed and updated on all endpoints.
• Ensure that the firewall only allows inbound connections on port 25 to Messaging Gateway security devices.
• Ensure that outbound connections to port 25 from your internal network are limited to SMG or other trusted mail sources.
• Confirm that your externally facing IP address or network is not listed as a spam source. See  Symantec IP Reputation Investigation.