SMTP Code: "421 4.4.0 [internal] no MXs for this domain could be reached at this time" and emails are stuck in the delivery queue
book
Article ID: 177595
calendar_today
Updated On:
Products
Messaging Gateway
Issue/Introduction
Symantec Messaging Gateway (SMG) shows messages in the delivery queue with the message "421 4.4.0 [internal] no MXs for this domain could be reached at this time".
Cause
This is not an error but a description of why the message could not be delivered. The message indicates a general mail delivery attempt failure in which the appliance could not communicate with the remote mail system. This may be the result of an inability to successfully connect to the remote host, to resolve the MX records, or to resolve the DNS host names for the email domain to which the appliance is attempting message delivery. This can also be seen if a Control Center host's Quarantine SMTP listener is not available on port 41025.
Possible circumstances that may cause this issue:
The local MTA (SMG) cannot communicate with the remote MTA.
Connection refused by remote MTA
Connection times out while trying to connect to the remote MTA
Mail Exchange (MX) record(s) and A records missing
Firewall rule blocking connection from local MTA IP address
A remote Control Center's Quarantine SMTP listener is not available on port 41025 (for Quarantine bound Email)
DNS query failure for calls larger than 512 bytes ( DNS UDP packet size is 512 bytes as defined in RFC1035, longer messages are truncated, with the query retried over TCP) ensure firewall policies are allowing TCP/UDP port 53.
Microsoft KB 828263
Resolution
Verify that the recipient's MX record can be resolved:
Connect to the SMG scanner via SSH to access the CLI
Execute the following command (replace example.com with the domain that mail is not being delivered to):
nslookup -type=mx example.com
If the above command times-out, or if the test fails, then there is an issue with DNS resolution and it is recommended that the SMG's DNS settings be reviewed
If the above command is successful, proceed to step 2
Verify connectivity to the IP address from step 1:
Connect to the SMG scanner via SSH to access the CLI
The SMG setting that controls which IP interface is used for delivery of non-local messages can be found by connecting to the SMG's GUI and navigating to Administration -> Configuration -> <scanner> ->SMTP -> Advanced Settings -> Delivery.
If the command above fails, then the message returned will indicate whether the target IP address cannot be reached, times-out, or is rejecting the connection
If the command above succeeds, then the original failure may have been due to an intermittent connectivity issue.