Mailing List CGatePro@mail.stalker.com Message #105433
From: Alastair Burr <alastair.burr@bluestar-software.co.uk>
Subject: SMTP Error from MailMarshal - message does not end with the dot-line
Date: Thu, 29 Jan 2015 14:22:02 +0000
To: <CGatePro@mail.stalker.com>
Hello,

We have had reports that some mail is not getting into our email server (running CommuniGate v6.1c1 on linux x86_64) and it appears that those reporting issues are all being sent via MailMarshal. The error message in the logs is: "failed to receive message body (424 bytes). Error Code=message does not end with the dot-line".

Has anyone else seen this before? I presume the issue maybe with this MailMarshal product. The sender has informed us that the same emails which were CC'ed to other people are getting through to other MTAs (e.g. Exchange / Zimbra etc.), so it appears to be a CommuniGate / MailMarshal specific problem.

I think it maybe MailMarshal because I connected back to the MTA that was sending the email to us (just via telnet on port 25) to check what mail product was shown and got prompted with "MailMarshal (v7.1.2.5326)" on one server and "MailMarshal (v6.9.8.3800)" on another which had the same issue.

I have included an example of the output in our logs with full SMTP logs enabled (I've just obscured our internal IP addresses, email addresses and removed the TLS fingerprint for safety):

13:44:19.113 5 SMTP [0.0.0.0]:25 <- [194.83.68.252]:13557 connection request. socket=100
13:44:19.113 5 SMTP new VStream created, 1 total
13:44:19.113 5 SMTP stream thread started
13:44:19.113 4 SMTPI-022641([194.83.68.252]:13557) [10.x.x.x]:25 <- [194.83.68.252]:13557 incoming connection(bluestar-software.co.uk)
13:44:19.290 5 SMTPI-022641([194.83.68.252]:13557) out: 220 bluestar-software.co.uk ESMTP CommuniGate Pro 6.1c1\r\n
13:44:19.364 5 SMTPI-022641([194.83.68.252]:13557) inp: EHLO marshal.bcot.ac.uk
13:44:19.364 5 SMTPI-022641(marshal.bcot.ac.uk) out: 250-bluestar-software.co.uk is pleased to meet you\r\n250-DSN\r\n250-SIZE 104857600\r\n250-STARTTLS\r\n250-ETRN\r\n250-TURN\r\n250-ATRN\r\n250-NO-SOLICITING\r\n250-8BITMIME\r\n250-HELP\r\n250-PIPELINING\r\n250 EHLO\r\n
13:44:19.440 5 SMTPI-022641(marshal.bcot.ac.uk) inp: STARTTLS
13:44:19.440 5 SMTPI-022641(marshal.bcot.ac.uk) out: 220 please start a TLS connection\r\n
13:44:19.513 2 TLS-040979 created(TLSv1.0,AES256_SHA) for SMTPI-022641
13:44:19.513 4 SMTPI-022641 TLSv1.0 as SSLv2 hello: method=AES256_SHA, TLS-040979 id=<removed>
13:44:19.513 4 SMTPI-022641 TLSv1.0 h-out (70): server_hello
13:44:19.513 5 SMTPI-022641 TLS out<22> (74): <removed>
13:44:19.513 4 SMTPI-022641 certificate SHA-256 fingerprint=<removed>
13:44:19.513 4 SMTPI-022641 TLSv1.0 h-out (2195): certificate
13:44:19.513 5 SMTPI-022641 TLS out<22> (2199): <removed>
13:44:19.513 4 SMTPI-022641 TLSv1.0 h-out (0): server_hello_done
13:44:19.513 5 SMTPI-022641 TLS out<22> (4): 0E 00 00 00
13:44:19.698 4 SMTPI-022641 TLSv1.0 h-inp (258): client_key_exchange
13:44:19.733 4 SMTPI-022641 TLSv1.0 security initiated
13:44:19.733 4 SMTPI-022641 TLSv1.0 out(1): change_cipher
13:44:19.733 5 SMTPI-022641 TLS out<20> (1): 01
13:44:19.733 4 SMTPI-022641 TLSv1.0 inp(1): change_cipher
13:44:19.733 5 SMTPI-022641 TLS s-inp<22> (16): 14 00 00 0C FB AB 81 65 94 F7 48 AD 65 AF 9C C6
13:44:19.733 4 SMTPI-022641 TLSv1.0 h-inp (12): finished
13:44:19.733 4 SMTPI-022641 TLSv1.0 h-out (12): finished
13:44:19.733 5 SMTPI-022641 TLS s-out<22> (16): 14 00 00 0C CD 97 33 EF CE 0F 35 1E 18 8D DE 5C
13:44:19.733 5 SMTPI-022641 handshaker released
13:44:19.733 4 SMTPI-022641(marshal.bcot.ac.uk) TLS-040979(AES256_SHA) connection accepted for 'bluestar-software.co.uk'
13:44:20.106 5 SMTPI-022641 TLS s-inp<23> (0):
13:44:20.106 5 SMTPI-022641 TLS s-inp<23> (25): 45 48 4C 4F 20 6D 61 72 73 68 61 6C 2E 62 63 6F 74 2E 61 63 2E 75 6B 0D 0A
13:44:20.106 5 SMTPI-022641(marshal.bcot.ac.uk) s-inp: EHLO marshal.bcot.ac.uk
13:44:20.107 5 SMTPI-022641(marshal.bcot.ac.uk) s-out: 250-bluestar-software.co.uk is pleased to meet you\r\n250-DSN\r\n250-SIZE 104857600\r\n250-ETRN\r\n250-TURN\r\n250-ATRN\r\n250-NO-SOLICITING\r\n250-8BITMIME\r\n250-HELP\r\n250-PIPELINING\r\n250 EHLO\r\n
13:44:20.107 5 SMTPI-022641 TLS s-out<23> (180): 32 35 30 2D 62 6C 75 65 73 74 61 72 2D 73 6F 66 74 77 61 72 65 2E 63 6F 2E 75 6B 20 69 73 20 70 6C 65 61 73 65 64 20 74 6F 20 6D 65 65 74 20 79 6F 75 0D 0A 32 35 30 2D 44 53 4E 0D 0A 32 35 30 2D 53 49 5A 45 20 31 30 34 38 35 37 36 30 30 0D 0A 32 35 30 2D 45 54 52 4E 0D 0A 32 35 30 2D 54 55 52 4E 0D 0A 32 35 30 2D 41 54 52 4E 0D 0A 32 35 30 2D 4E 4F 2D 53 4F 4C 49 43 49 54 49 4E 47 0D 0A 32 35 30 2D 38 42 49 54 4D 49 4D 45 0D 0A 32 35 30 2D 48 45 
13:44:20.207 5 SMTPI-022641 TLS s-inp<23> (0):
13:44:20.207 5 SMTPI-022641 TLS s-inp<23> (45): 4D 41 49 4C 20 46 52 4F 4D 3A 3C 54 69 6D 2E 4D 61 72 74 69 6E 40 62 63 6F 74 2E 61 63 2E 75 6B 3E 20 53 49 5A 45 3D 33 33 39 34 0D 0A
13:44:20.207 5 SMTPI-022641(marshal.bcot.ac.uk) s-inp: MAIL FROM:<from.user@bcot.ac.uk> SIZE=3394
13:44:20.207 4 SMTPI-022641(marshal.bcot.ac.uk) checking MX-record for bcot.ac.uk
13:44:20.208 5 SMTPI-022641(marshal.bcot.ac.uk) s-out: 250 from.user@bcot.ac.uk sender accepted\r\n
13:44:20.208 5 SMTPI-022641 TLS s-out<23> (43): 32 35 30 20 54 69 6D 2E 4D 61 72 74 69 6E 40 62 63 6F 74 2E 61 63 2E 75 6B 20 73 65 6E 64 65 72 20 61 63 63 65 70 74 65 64 0D 0A
13:44:20.284 5 SMTPI-022641 TLS s-inp<23> (0):
13:44:20.284 5 SMTPI-022641 TLS s-inp<23> (49): 52 43 50 54 20 54 4F 3A 3C 65 64 77 61 72 64 2E 6A 61 63 6F 62 73 40 62 6C 75 65 73 74 61 72 2D 73 6F 66 74 77 61 72 65 2E 63 6F 2E 75 6B 3E 0D 0A
13:44:20.284 5 SMTPI-022641(marshal.bcot.ac.uk) s-inp: RCPT TO:<to.user@bluestar-software.co.uk>
13:44:20.284 5 SMTPI-022641(marshal.bcot.ac.uk) s-out: 250 to.user@bluestar-software.co.uk will leave the Internet\r\n
13:44:20.284 5 SMTPI-022641 TLS s-out<23> (67): 32 35 30 20 65 64 77 61 72 64 2E 6A 61 63 6F 62 73 40 62 6C 75 65 73 74 61 72 2D 73 6F 66 74 77 61 72 65 2E 63 6F 2E 75 6B 20 77 69 6C 6C 20 6C 65 61 76 65 20 74 68 65 20 49 6E 74 65 72 6E 65 74 0D 0A
13:44:20.359 5 SMTPI-022641 TLS s-inp<23> (0):
13:44:20.359 5 SMTPI-022641 TLS s-inp<23> (6): 44 41 54 41 0D 0A
13:44:20.359 5 SMTPI-022641(marshal.bcot.ac.uk) s-inp: DATA
13:44:20.359 5 SMTPI-022641(marshal.bcot.ac.uk) s-out: 354 Enter mail, end with "." on a line by itself\r\n
13:44:20.359 5 SMTPI-022641 TLS s-out<23> (50): 33 35 34 20 45 6E 74 65 72 20 6D 61 69 6C 2C 20 65 6E 64 20 77 69 74 68 20 22 2E 22 20 6F 6E 20 61 20 6C 69 6E 65 20 62 79 20 69 74 73 65 6C 66 0D 0A
13:44:20.440 5 SMTPI-022641 TLS s-inp<23> (0):
13:44:20.440 3 SMTPI-022641(marshal.bcot.ac.uk) failed to receive message body (424 bytes). Error Code=message does not end with the dot-line
13:44:20.440 4 SMTPI-022641(marshal.bcot.ac.uk) TLS connection is closing
13:44:20.440 5 SMTPI-022641 TLS s-out<21> (2): 01 00
13:44:20.440 2 TLS-040979 closed by SMTPI-022641
13:44:20.440 5 SMTPI-022641 TLS released
13:44:20.440 4 SMTPI-022641(marshal.bcot.ac.uk) closing connection
13:44:20.440 4 SMTPI-022641(marshal.bcot.ac.uk) releasing stream

We have seen this from other domains too. Any ideas on whether this could just be CommuniGate either closing the connection too soon (or something like this) or if there is anything we can do? Or do I need to approach the MailMarshal developers / community?

I think their website is here: https://www3.trustwave.com/support/mailmarshal-smtp/

-- 
Alastair Burr
Senior Engineer & Project Coordinator, Bluestar Software
Telephone: +44 (0)1256 882695
Web site: www.bluestar-software.co.uk
Email: alastair.burr@bluestar-software.co.uk


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
DISCLAIMER: This email message and any attachments is for the sole
use of the intended recipient(s) and may contain confidential and
privileged information.  Any unauthorised review, use, disclosure
or distribution is prohibited. If you are not the intended recipient,
please contact the sender by reply email and destroy all copies of
the original message.

The views expressed in this message may not necessarily reflect the
views of Bluestar Software Ltd.

Bluestar Software Ltd, Registered in England
Company Registration No. 03537860, VAT No. 709 2751 29
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster