La educación inclusiva

This section describes some common SMTP Relay service issues and troubleshooting procedures.

SMTP Relay Service Not Accepting Messages

Full SQL Server file groups can cause the Email Firewall SMTP Relay service to stop accepting messages. The available space in seven file groups configured for the Email Firewall database affect inbound message acceptance. These are:

MMSBodyChunk MMSBodyChunkStatic MMSEventData MMSMessageData MMSMessageDataStatic

MMSMessageDataPropertiesStatic MMSTransactionLog

space goes below 75%. A warning will be logged with the list of file groups and the percentage of space used.

This full file group problem can be solved by increasing the file size of the file group. Before doing so, you need to determine which file group size needs to be increased. When you have determined this, increase the file group size.

Procedures for doing so are described in3.6.1 Troubleshooting Inbound Queue Backups -- Full File Groups on page 139.

Email Firewall Relay Not Identifying Itself Properly

The SMTP Host Name configuration parameter for the Email Firewall Relay service affects all of the following:

• The message returned in response to new inbound connections:

Example: 220 server1.example.com SMTP Relay Service ready

• The message returned in response to the _EHLO command.

• The message returned in response to a QUIT command.

• The Received: header inserted into all messages received by the inbound SMTP Relay.

• The HELO and EHLO commands generated by the outbound SMTP Relay:

Example: HELO server1.tumbleweed.com

• The Message-Id: header generated for new notifications created by the Email Firewall SMTP Relay.

• The Reporting-MTA: header in delivery status notifications (DSNs).

In some circumstances, Email Firewall may not identify itself with a fully qualified host name. This is because Email Firewall gets the hostname it uses to identify itself from the host machine operating system's TCP/IP properties. If this information is not configured properly, the connection may be rejected. If your server does not identify itself using its fully qualified host name, some connecting hosts or destination domains may reject your messages with an error message similar to the following:

Unexpected recipient failure - 504 server1: HELO command rejected: need fully-qualified hostname

To adjust the host name identification, you may need to adjust the TCP/IP properties. In particular, Email Firewall looks for the Windows Registry values named Hostname and Domain under the following key:

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters

If the _Domain value is missing, Email Firewall will try to use the value of DhcpDomain. Although Windows stores these values in the registry, they are usually edited from the Network Control Panel, TCP/IP Properties.

To adjust the hostname identification, you can adjust the operating system's TCP/IP properties.

To adjust the TCP/IP properties in Windows 2000:

1. In My Computer, select Properties.

2. In the Network Identification tab, click Properties. 3. In the Identification Changes dialog box, click More. 4. Type the Primary DNS suffix of this computer information:

For example, for server1.example.com, the server name is server1 and the Primary DNS suffix is example.com.

5. Click OK, then OK, and then OK to close the open dialogs.

Alternatively, you may want to override the host machine’s TCP/IP properties by specifying the value as described in Specifying the Relay Host Name on page 39.

Troubleshooting Outbound Message Backlogs

If outbound SMTP performance seems to be below expectations, there are two relay parameters, Message Backlog Per Host Percent and Max Message Backlog, that may be investigated. Under normal circumstances these parameters should not need to be edited.

Following is a description and explanation of how the SMTP Relay parameters Message Backlog Per Host Percent and Max Message Backlog are used.

As each outbound SMTP Relay service processes a message from the outbound queue: after initiating a database transaction on that message, the next step is for the Relay to use the appropriate routing rule to determine the ordered sequence of relay hosts to which that message may be routed. This may or may not involve DNS queries, depending on the routing rule.

Once the Relay has decided that it is going to attempt to relay a message to a specific host, it checks to see if it already has any connections open to that host.

If so, the SMTP Relay may decide to keep the database transaction open and put

It is important to keep in mind that the backlog cache is a per-Relay service data structure. It is not a common cache that is shared by all outbound SMTP Relay services referencing the same Email Firewall database.

The Max Message Backlog parameter indicates the maximum number of messages that are permitted to be in the backlog cache for any one SMTP Relay.

In other words, the Max Message Backlog value is a limit on the number of database transactions that may be kept alive by an outbound SMTP Relay in the background while it is actively working on outbound message transactions.

The Email Firewall SMTP Relay imposes a limit on the number of messages in the backlog cache that will be routed to any one host (IP address). By default, no more than 20 percent of the messages in the backlog cache can be cached for the same relay host. The Message Backlog Per Host Percent parameter allows this percentage limit to be modified.

The default value for Max Message Backlog is 10, but it is recommended that you increase this value to 20 if there will be only one outbound SMTP Relay service actively referencing an Email Firewall database. It is recommended that you do not set the value higher than this because of the risk of consuming too many SQL Server database locks.

Since the default value for Message Backlog Per Host Percent is 20, Email Firewall will allow only 2 messages in the backlog cache at one time that need to be routed to the same host (because 2 is 20 percent of 10). If you have increased the Max Message Backlog to 20, there may be up to 4 messages in the backlog cache for one host (4 is 20 percent of 20).

It may improve outbound mail performance to increase the Message Backlog Per Host Percent if all mail is routed to a very small number of relay hosts.

For example, if all internal mail is routed to an internal mail server and all external mail is routed to another relay host in the DMZ, it would make sense to increase this parameter to 50.

When determining the settings for these two parameters, you should also take into consideration the maximum connections per host value that has been set on the Setup > Relays page. For example, if you have configured the maximum connections per host to 3, you might want to make sure that the backlog cache is configured to allow at least 3 messages to be routed to the same host for best performance.

To make changes to these parameters, use the Configuration Editor in Email Firewall Web Admin. See 10.11 Using the Configuration Editor on page 609.

Troubleshooting TLS

• The TLS certificate domain name match must be exact.

The designated domain can be used to override this in some situations.

• MX records should specify a host name. MX records that specify an IP address instead of a host name will cause problems for TLS.

• Root certificates must be trusted for TLS purposes.

Use Web Admin to set this option on root certificates that are being used by remote domains’ certificates.

• Inconsistencies between Mail Routing Rules and Network Connections can cause problems.

For example, the Routing Rule may require TLS, but the client connection comes from a host for which TLS has not been enabled.

• If the Network Connections option is set to request a certificate, that certificate must be trusted for TLS to work.

• If Email Firewall event logging is insufficient to diagnose problems, use the EMF Debug Log Capture tool. Forward the results to Tumbleweed Global Support for assistance if needed.