SMTP Code: "421 4.4.0 [internal] failed to connect: no mail servers for this domain could be reached at this time"

Products

• Messaging Gateway

Issue/Introduction

You have noticed that the Messaging Gateway cannot deliver some outbound emails. These emails stay in the delivery queue with the message "421 4.4.0 [internal] failed to connect: no mail servers for this domain could be reached at this time."

Message Audit Log shows:

Error 421 4.4.0 [internal] failed to connect: no mail servers for this domain could be reached at this time.
Attempted Delivery to: default-non-local-route

Delivery queue shows:

Route: default-non-local-route
Last error: Error 421 4.4.0 [internal] failed to connect: no mail server for this domain could be reached at this time.

Cause

This message may be caused by a number of different situations. Some typical examples are:

• The destination mail server is offline
• The destination mail server has replied with a "421 try again later" response.
• The destination mail server is unreachable due to firewall restrictions on connections to port 25
• The destination mail server is unreachable due to network routing problems

Resolution

To investigate this issue:

1. Confirm SMTP connectivity to the internet and the destination mail server / domain
2. Ensure that firewall rules allow the IP / interface specified in SMTP Delivery Bindings to connect to the internet on port 25

Confirm SMTP connectivity to the destination mail server / domain

A telnet test from the SMG admin command line may be used to confirm whether SMG is able to connect to the destination mail server.

1. Connect to the SMG scanner command line as admin
2. Look up the MX records for the destination mail server
   nslookup -type=mx domain.test
3. Attempt a simple telnet connection test to one or more of the hostnames returned by the MX lookup
   telnet mail.domain.test 25

Example

smg [10.9.2-6]> nslookup -type=mx domain.test
*** Invalid option: silent
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
domain.test    mail exchanger = 20 mx2.domain.test.
domain.test    mail exchanger = 10 mx1.domain.test.

Authoritative answers can be found from:

smg [10.9.2-6]> telnet mx1.domain.test 25
Trying 192.0.2.25...
telnet: connect to address 192.0.2.25: Connection timed out
Trying 2001:db8::25...
telnet: connect to address 2001:db8::25: Network is unreachable

Please see Troubleshoot email delivery issues using telnet for a detailed description of how to test SMTP connectivity and delivery via the telnet command.

Confirm Delivery bindings for non-local / outbound email delivery

If Messaging Gateway is configured with more than one IP address, one of those IPs will be used for non-local email delivery i.e. delivery of email to the Internet. To confirm which IP SMG is using for non-local email delivery:

1. Log into the Control Center as an administrator
2. Go to Administration > Configuration > host > SMTP > Advanced Settings > Delivery
3. The Delivery Bindings section shows which IP is selected for non-local email delivery
4. Confirm with your network security team which SMG IPs are allowed to connect to the internet on port 25

This applies to

• Scanner with two IP addresses; one IP address for inbound connections, and the other IP address for outbound connections.
• The Advance SMTP configuration shows: Non-local messages: Auto
• The SMG inbound IP is not allowed to reach the remote domain (firewall rejects the connection, for example).

Additional Information

• Troubleshoot email delivery issues using telnet