"421 esmtp: protocol deviation" and "Abort" action for inbound messages listed in Message Audit Logs

Products

• Messaging Gateway

Issue/Introduction

Some inbound messages, potentially from specific senders, are very delayed or are not delivered. The sender may report that their delivery is being deferred with a "421 esmtp: protocol deviation" response.

Environment

Release : 10.7.X, 10.8.X, 10.9.0

Cause

A protocol deviation response is a deferral response to the sender caused by the mail transaction deviating from the SMTP protocol. A defer response is a "try again" response, so the sending email server will try to deliver the message again until it is delivered or times out.

A protocol deviation occurs when the sender does not follow the required processes defined by the various SMTP RFC documents. In particular, we often see this when the sender tries to use the "Pipelining" SMTP extension, but does not appropriately adhere to the protocol requirements. Pipelining is an extension that allows a mail server to immediately provide multiple commands without waiting for a response, in order to speed up the message delivery. However, some key commands require waiting for a response to ensure the transaction state does not change. If the sender mail server does not properly wait for required responses, a "protocol deviation" can occur. This is one common example, but other failures to comply with the SMTP protocol can also occur. A packet capture is the best way to understand the issue.

Resolution

The Messaging Gateway is working as designed. The device that is not following SMTP protocol should be updated or modified to ensure protocol compliance.

Additional Information

The Messaging Gateway defers message transactions that deviate from the SMTP protocol because legitimate mail servers should be following SMTP protocol correctly. Malicious senders often do not follow protocol.

The Messaging Gateway support team has recently seen an increase in some senders not using the PIPELINING extension properly, causing protocol deviations. Messaging Gateway support has a workaround for PIPELINING related protocol deviations. If you are experiencing this issue contact Broadcom Support for more information and to determine if this workaround can be used to work around the sender issue for your mail flow.