Event Code 2317 due to SMTP Relay Throttling (Error 421)
Article ID: 440489
Updated On:
Products
Issue/Introduction
The DLP Enforce Console reports the following system event:
- Code: 2317
- Summary: Failed to send incident email notification
- Detail: "Email notification was not sent for Incident [ID] and Policy [Name]. Could not connect to SMTP host: [Host Address], port: 25, response: 421"
Intermittent failures are observed where some notifications are delivered successfully while others fail with the 421 response code.
Environment
- Data Loss Prevention Enforce
- External SMTP Relay (e.g., Proofpoint, IronPort, Exchange)
Cause
The upstream SMTP relay is returning a 421 SMTP response code. This typically indicates that the relay has reached its maximum allowed number of simultaneous connections or is rate-limiting the Enforce server's IP address.
Because the DLP Enforce server does not currently have a built-in retry mechanism for failed Response Rule notifications, any connection rejected by the relay results in a permanent failure for that specific notification attempt
Resolution
1. Increase SMTP Relay Connection Limits
Work with your email or security team to adjust the settings on the SMTP gateway (e.g., Proofpoint):
- Increase the Simultaneous Connection Limit allowed from the Enforce Server IP.
- Whitelist the Enforce Server IP from rate-limiting or reputation-based throttling.
2. Throttle DLP Response Rules
If the relay limits cannot be adjusted, reduce the number of concurrent SMTP sessions initiated by Enforce:
- Review Response Rules to ensure multiple high-volume alerts are not scheduled to fire at the exact same time.
- Consolidate incident notifications to reduce the total number of individual emails being generated per incident.
3. Implement 'Block SMTP Message' (Network Prevent for Email only)
If the failure involves sender notifications for blocked emails, consider using the Block SMTP Message response rule instead of Send Email Notification.
- Block SMTP Message is handled by the Detection Server and passed directly to the MTA, which may handle retries more effectively than the Enforce server .
4. Endorse Feature Request
Request to be added as an endorser for ISFR-2898, which seeks to add a configurable retry interval for failed email notifications sent via Enforce response rules.
Additional Information
Feedback
