NDR from Symantec MGW when it can't send e-mail

[Markko Meriniit]

  Hello

  I got a case where there was something wrong with e-mail and Symantec MGW could not send e-mail to internal server. It tried 5 days and then sent the NDR. But seems I have some misconfiguration somewhere because it sent NDR to gmail address through internal email server. And of course it didn't went anywhere. I tried to figure out what was wrong but got stuck. Any help or hints about what I should change in conf?

Markko Meriniit

[alexander smg]

Unclassified | Non classifi?

Say what.

[Markko Meriniit]

I try to make it even simpler. Mail comes from [e-mail] to SMGW. SMGW tries to send it to the destination email server but can't because there is some kind of problem. So it sits on SMGW delivery queue and SMGW tries to send it again after every 4 hour during 5 days. Then it finds that it's enough and sends NDR, Non-Delivery Report message to the [e-mail] address. That e-mail should go out to the gmail server but for some reason SMGW sends it through the internal EMAIL server which doesn't handle any other email but corporate domain email. So the NDR message get's rejected and doesn't reach to the [e-mail] address like it should.

[alexander smg]

Unclassified | Non classifié

WHAT IS THE error in the audit logs. Gmail thinks you IP is bad. booooooooooooooo

[Markko Meriniit]

  Hello alexander

 as I wrote it doesn't send the NDR message to the gmail server. It sends it to our internal email server. There is no problem with the sending but as our internal email server doesn't handle emails for gmail then it just gets dropped.

Markko Meriniit

[Andrey Fyodorov]

Hi Markko, it seems like your Outgoing SMTP route may be misconfigured. But it is hard to tell without seeing your settings.

[Markko Meriniit]

  Hello

 I have gone through all settings (Protocols - SMTP - Settings, Admin - hosts - config) but I didn't see anything that can be identified as "Outgoing SMTP route". SMGW has one interface and is used only for Inbound scanning. One server sends all mail to it and SMGW scans and sends emails which should be OK to  the internal mail server. 

Markko Meriniit

[alexander smg]

Unclassified | Non classifi?

If google hates you, then check your ip reputation. What is your public sending ip ??

[Markko Meriniit]

  Dear alexander,

it seems you don't even read what was written. Google isn't my problem. My problem is that SMGW sends email the wrong way, not to the internet where the email should go but to my internal network.

Markko Meriniit

[alexander smg]

Unclassified | Non classifi?

Then how does any email leave. Who the **** configured your smgs.

[Andrey Fyodorov]

Do you have any servers/gateways that [know how to] send emails to the Internet?

[Markko Meriniit]

  Of course we have. Email comes in and out every day. I just can't figure out where do I say to SYMGW that send this type of emails out, to the internet, not inside, to the organization.

Markko Meriniit

[Andrey Fyodorov]

What system is responsible for sending emails out, Markko?

If you are saying that your SMG is only processing inbound emails, that makes me wonder where your outbound routes are defined.

[alexander smg]

Unclassified | Non classifi?

His config makes no sense.

[Markko Meriniit]

 We have email server on DMZ (lets say its name is E) which takes all emails from outside and sends them to the SMGW (which is configured only for in Inbound scanning so it's processing only emails on inbound direction) which scans emails and forwards emails to internal email server. Internal email server receives emails from internal clients and sends them outside through the E on DMZ. We have no problems with mail flow. We have problem with one specific case. And its when SMGW can't send email to the internal server and sends NDR. And that NDR goes in wrong direction, to internal email server, not to the server E like it's supposed to.

I start to wonder if there really is any person here who actually knows anything about SMGW...

[alexander smg]

Unclassified | Non classifié

How can it be that you all mail working but one domain?? That’s a routing issue. And when did it start?? This is very strange.

[Andrey Fyodorov]

This is because your SMGW only knows how to send *everything and anything*, including any NDRs to your internal email server. It doesn’t know how to send anything out to the internet.

Now, your internal email server *should* be able to figure out, with your help, how to route our that NDR via your E server. You probably need to allow your internal mail server to SMTP-relay emails to any recipient that it may receive from the IP address of your SMGW.

[alexander smg]

Unclassified | Non classifié

There is so much technical details missing about this config. It makes no sense that all mail routes and delivers correctly but one domain. It's a routing issue. Pics, details, are all missing.

[Markko Meriniit]

 I'm sure know that SMGW only knows how to send *everything and anything*, including any NDRs to my internal email server. And that's the problem for what I'm looking solution. It really doesn't help if you repeat my problem back to me without being able to even give some hints what the solution may be. Problem is SMGW conf, not my internal mail server.

[Andrey Fyodorov]

Hi Markko, your SMGW is literally configured to not be able to send anything out. This includes NDRs too.

It routes *everything* to your internal email server.

So you need to figure out how to set up your internal email server to take these NDRs from your SMGW and route them out to the Internet.

This is not a deficiency of the SMGW in any way.

[alexander smg]

Unclassified | Non classifi?

Like I said. There are many critical details missing

[Markko Meriniit]

  Hello alexander, and what are these "critical details" what are missing? I have laid out what the setup is and what the problem is. If you know what are these critical things then you should be able to ask some specific questions about specific settings but I haven't seen you doing that.

[alexander smg]

Unclassified | Non classifi?

Show me a pic of your config of the domains, advanced settings, and outbound, inbound. And a pic. And show the log that shows the failure. All of it.

[Markko Meriniit]

  Hey alexander, I'm not gonna show these things because it would be stupid. If you would know what setting would be relevant then you would ask about it But seems you don't know so you ask to see bunch of irrelevant stuff. Failure in log file? What good that does. And FYI, I solved the problem so there is no need to speculate about stuff you have no idea about.

Markko Meriniit

[alexander smg]

Unclassified | Non classifi?

So you fixed you own routing issue based on my guidance. Perfect. Now the world is better again.

[Markko Meriniit]

 Hey alexander, you gave exactly zero guidance. Just complained how you don't understand what the problem is. You don't even know know what the solution was. Just general "routing problem" which is what I described in this thread myself and you repeated it.

[alexander smg]

Unclassified | Non classifi?

U r welcome for my solution. Now move on.

[alexander smg]

Unclassified | Non classifié

So since you are not qualified. Tell us oh great weirdo, what routing fail did you enable that u undid to fix your own mistake. Lame.

[Markko Meriniit]

  Hey Andrey,

my SMGW works fine and sends emails out from itself to my internal email server every day. So  the statement "your SMGW is literally configured to not be able to send anything out" is demonstrably incorrect. And again, you repeating my problem, "It routes *everything* to my internal email server", does not help me. I know what the problem is. I came here to get some advice or hints how I can find out what setting could be misconfigured. It's the problem of SMGW configuration, not configuration of internal email server. And I definitely not gonna configure my email server to be SMTP relay server. That's not its purpose. So if you don't have any idea what could be misconfigured in SMGW then please, stop answering. It's pointless and tedious.

[Andrey Fyodorov]

OK, man. Open a support ticket with Broadcom then, and they will tell you the same exact thing, one more time.

/Peace out.

[Markko Meriniit]

 Hey Andrey, I solved the problem although none of you could even give a hint where in SMGW conf I might take a look. I said that I have a problem with NDR going to wrong server, you repeated my problem back with slightly different wording. I can't comprehend how it could help anyone when you just go and repeat the other person problem constantly without offering any real solution.

[alexander smg]

Unclassified | Non classifi?

So u fixed were what

[Markko Meriniit]

 Hello alexander, you tell me where in configuration problem was. You claimed that you gave me a guidance so you should have at least some idea where it was.

[alexander smg]

Unclassified | Non classifié

I’m too awesome for you.

[IT Support Admin]

In SMG web UI go to Administration | Configuration | click each host name link for your scanners one by one | SMTP tab | Outbound tab | scroll down to Outbound Non-Local Mail Delivery | and you can set Use MX Lookup for non-local domain mail to use DNS MX records for mail to domains that are not local and defined as domains in SMG. As long as the MX records can be found from the scanner, it should be able to route non-local domains from that scanner. Remember to check each one-by-one if you have more than one. 

If you are using Relay non-local domain mail to the following hosts, then check each host one-by-one to ensure those allow traffic from the scanner IPs to them, and that those are able to route. I believe it should be as simple as that. 

Please ensure in Mail Filtering section, that Inbound and outbound mail filtering is the option selected on each scanner config one-by-one. 

The web UI takes some getting used to as I've been bit by that before and it was simple options to ensure are selected and that your configuration is properly configured. 

Keep us posted on if this helps any or not.

[IT Support Admin]

If it is regarding inbound mail, check Protocols | Domains | define your local domains one-by-one | Acceptance | ensure local domain is selected. In the Delivery tab set the domain to use either MX or point it to a destination host. Define your TLS and DKIM accordingly where applicable. If you are routing to M365 or some other 3rd party email service, you will want to ensure you understand where you should be routing those domains to based on their provided configuration guidance. It's all super easy once you get a rep or two under your belt.

My apologies for not reading every posted response, but it sounds like you may have already gotten it straightened out. Ensure you document the issue on your side should it pop up two years down the road and you forget, it might be helpful for that sort of reason.

[IT Support Admin]

On incoming domain acceptance, in the Delivery tab, TLS Encryption section, if you want Require TLS, I'd be sure to pick Require TLS and don't verify certificate. It seems many mail server we cannot control are not using proper TLS and this is common for the TLS cert to not match the domain. I've been there and done that too. SMG advanced logs, network traces, etc. and that ended up being the case and what SMG support told me and also my further investigation confirmed as well. I'll stop pinging this post now.

[Markko Meriniit]

   Hello.

 Yes, I already figured it out and non-local domain relay was initially incorrectly configured. After I changed that NDR's started to move in right direction. But thank you is still appropriate because that answer would helped me in right direction.

Markko Meriniit

[alexander smg]

Unclassified | Non classifi?

So I was right. Just admit it.

[IT Support Admin]

It looks like you were on the right track, but the responses weren't clear enough. A straightforward guide on where to select and what to check would have likely been all that was needed. After some additional exploration of the web UI, they were able to get things running smoothly with big progress!

From what I've seen in various SMG/Broadcom tech docs, clearer wording could really make a difference. This is just another instance of the same issue-navigating what to check and where in the SMG web UI, with the usual documents and posts not being as clear about addressing common questions.

Have a great day Awesome Alexander from the SMG posts!!

[alexander smg]

Unclassified | Non classifié

Correct, my awesomeness did provide the correct answer to assist in the solution. Nice.

[IT Support Admin]

Okay, sure.... Yes, Alexander is awesome, and great! Alexander the King for Planet SMG posts! No corruption, all the people will vote for his awesomeness and President of SMG thread posts! Go vote for Alexander!

[alexander smg]

Unclassified | Non classifié

Finally. U now understand. woohoo

[IT Support Admin]

Much love to Alexander!!

[alexander smg]

Unclassified | Non classifié

Be nice

[Markko Meriniit]

  Hello alexander, your only advice here was to check if I'm on google's ****. I guess that's says all about your awesomeness.

[alexander smg]

Unclassified | Non classifié

Your description was the worst post to ever on this forum with zero info. By the grace of me, it was solved. You are welcome. Be thankful.

[Markko Meriniit]

Helo alexander, you were right about what? Nowhere in your posts you suggested that I should look at the non-local domain relay host. Or anywhere else. Nowhere. You didn't understand even what the problem was. Your first reaction was "say what". Then you thought that gmail rejects my email even when I specifically stated that SMGW sends email to internal server. Then you wanted screenshots about most of my config and errors from SMTP log. And then for some reason you congratulated yourself that you offered to me so good guidance that I got my problem solved. It just baffles me. No understanding of the problem, zero advice and still having such a good impression about yourself.

[alexander smg]

Unclassified | Non classifié

Your description was the worst post to ever on this forum with zero info. By the grace of me, it was solved. You are welcome. Be thankful.

[IT Support Admin]

I deduced from these points in your words on the original post:

• Symantec MGW could not send e-mail to internal server
• It tried 5 days and then sent the NDR
• it sent NDR to gmail address through internal email server
  

Then because of the words you provided such as "any help or hints", I was able to determine what you were asking on this while assuming perhaps English may not be your main language. If so or if not, you only get the inclusiveness features which a platform provides for such inquiries.

As a long-time lurker on the SE sites, with a strong reputation built across platforms like Super User, Server Fault, Database Administration, and others, I've gained enough knowledge to offer valuable insights and navigate the intricacies of written language in Q&A posts to sometimes understand them even when others cannot. For someone like me to read your post, I can sometimes help.

 

I wonder if Alexander could provide insight or helpful tips on how to write better questions on this platform, ensuring you get the most effective help without needing to open a support ticket. I'm always happy to assist when I have the time and a clear understanding of your technical needs, down to the details.

 

[alexander smg]

Unclassified | Non classifié

You, IT Support Admin, are better (and respectful) while "the other" person is yuk

[Markko Meriniit]

   Yes, english is not my first language and I guess I can express myself sometimes in a way which is unusual for english speakers. I really thought that I provided enough information about the problem and even tried to describe it in more details. But seems I was totally off and provided nothing. And instead of describing I should have been provided screenshots of all my SMGW configuration and my problem would have been solved instantly. I'm humbled.

[IT Support Admin]

I think you're good actually, it just depends on who reads your post that can help, and whether or not they can interpret to get you what you need. Someone like me, I understood what you were asking and needed. It's always a good thing to try to write better questions to attract more attention to get most optimal help. I do not think you need to provide screen shots of all your configurations in this specific case, but sometimes those things can be helpful for those that can help you potentially. In any event, I'm glad you got it resolved. 

Respectfully~

[alexander smg]

Unclassified | Non classifié

Correct. All of you be humbled. It is important to be nice.

[alexander smg]

Unclassified | Non classifié

Humbled you should be. "it support admin and I" are awesome. Remember to be nice.