As mails flow from sender to recipient through Symantec, there are two separate places that an SMTP connection can occur. By extension therefore, there are also two points of contact which can potentially serve up a server error.
The following ilustration shows how and when bounce-backs are generated
A quick and easy way for an administrator to establish where a bounce-back has generated is to review the postmaster email address of the bounce email.
If the sending server encounters an error when connecting to Symantec, then the sending server will issue the bounce-back.
However, if the sending address of the bounce-back is coming from "[email protected]" domain, then it means that the receiving server issued an error when Symantec attempted to deliver the email on to the intended domain.
The bounce-back will always be generated by the last MTA in possession of the email before being accepted by the next hop.