TLS test failure on clusterXa.eu.messagelabs.com clusters in Email Security.cloud

Products

• Email Security.cloud

Issue/Introduction

External TLS connectivity or blacklist tests against specific Email Security.cloud clusters may return failure results. These failures typically occur when testing against clusters containing an "a" in the hostname (e.g., cluster1a.eu.messagelabs.com).

Environment

Email Security.cloud

Cause

Clusters designated with an "a" (e.g., cluster1a, cluster5a) serve as security "tarpits" or honeypots within the Global Intelligence Network. These endpoints are designed to identify and slow down suspicious traffic, bots, and spam sources. They do not process legitimate email traffic in the same manner as primary clusters and are intentionally configured to be non-responsive or restrictive to standard probing.

Resolution

• Verify that TLS and connectivity tests pass against the primary cluster endpoint (e.g., cluster1.eu.messagelabs.com).
• Do not use clusterXa endpoints for performance, TLS, or availability testing.
• Ensure DNS MX records for the domain include both the primary and the "a" cluster, ensuring the "a" cluster has a higher preference number (lower priority).
• If the primary cluster passes TLS verification, the service is functioning as designed.