LUA: MAX connections exceeded: - message rejected

Products

• Messaging Gateway

Issue/Introduction

Messaging Gateway (SMG) is periodically deferring SMTP connections with the message "421 try again  later". When reviewing the logs, there are warnings that the maximum number of connections has been exceeded.

Note that there are two forms of this message which indicate different limits which have been exceeded:

• Total number of allowed connections  exceeded
  • 2025 Jun 28 09:45:21 EDT (warning) ecelerity: [10455] LUA: MAX connections exceeded: - message rejected.
• Maximum connections from a single host  exceeded
  • 2026 Mar 13 21:25:08 EDT (warning) ecelerity: [4551]LUA: MAX connections from host 10.144.103.136: - message rejected.

Cause

In its default configuration, SMG will only allow 2000 simultaneous SMTP connections to the inbound or outbound SMTP interface. SMG also limits the number of simultaneous connections per host / IP to 20.

When an external mail server attempts to connect to SMG and that connection would exceed either the total limit on SMTP connections or the limit on connections per host, the connection attempt is deferred with a status message to "try again later". The email message is not rejected but delayed and queued on the sending email server until there are fewer active SMTP connections to the SMG appliance.

Resolution

This warning message does not require administrative action. The upper limit on concurrrent connections is enforced to ensure that a connection flood does not negatively impact SMG's ability to accept and process mail.

It is not recommended that the default upper limit on connections be raised from the default value as the default is tuned to provide optimum message processing throughput.

Some SMG configuration options can slow down connection handling especially some reputation options or DNS checks. Please check the following:

• Protocols > Settings > DNS Validation - The DNS validation checks occur before the SMTP conversation begins. If DNS resolution is slow for some domains or connecting IPs, this can cause connection handling to slow down
• Reputation > Bad Senders > Third Party Bad Senders - Third party sender lists do not always have a guranteed availability or response time. Using one or more third party bad sender lists can slow down connection handling since the reputation check occurs before SMG presents the SMTP banner and begins the SMTP conversation.
• Reputation > Good Senders > Third Party Good Senders - As with third party bad senders, adding third party lists to SMG reputation checks can slow down connection handling.