Where does "Downstream server error" come from?
I had some problems with incoming mail that I tracked down to a configuration bug, two hosts on the same LAN configured to respond to the IP address of the MX. It's fixed now. While it was broken, attempts to send mail on some other systems got "421 Downstream server error." That is not a message that any of my mail software sends (I grepped for Downstream in the code, it's not there) so I presume it's from some middle box. Does anyone recognize the message, what produces it, and why? There was indeed stuff messed up downstream, but why turn it into a mystery error message? R's, John PS: I wonder how long it'll take for someone to suggest unhelpful configuration changes on my host to fix the problem.
I have seen this error whenever the destination server responds with some strange response, I have mostly seen it with iptables mucking packets. Problem occurs on the transport layer not the application so the application has no idea what to make of it... -------- Original message -------- From: John Levine Date:01/19/2014 5:57 PM (GMT-05:00) To: nanog@nanog.org Subject: Where does "Downstream server error" come from? I had some problems with incoming mail that I tracked down to a configuration bug, two hosts on the same LAN configured to respond to the IP address of the MX. It's fixed now. While it was broken, attempts to send mail on some other systems got "421 Downstream server error." That is not a message that any of my mail software sends (I grepped for Downstream in the code, it's not there) so I presume it's from some middle box. Does anyone recognize the message, what produces it, and why? There was indeed stuff messed up downstream, but why turn it into a mystery error message? R's, John PS: I wonder how long it'll take for someone to suggest unhelpful configuration changes on my host to fix the problem.
Perhaps the host prior to the ones that had the error were doing recipient checking?
Nope, I got the error immediately after trying to connect, before it could even send EHLO. R's, John
M. From: John Levine Sent: Sunday, January 19, 2014 17:56 To: nanog@nanog.org Subject: Where does "Downstream server error" come from?
I had some problems with incoming mail that I tracked down to a configuration bug, two hosts on the same LAN configured to respond to the IP address of the MX. It's fixed now.
While it was broken, attempts to send mail on some other systems got "421 Downstream server error." That is not a message that any of my mail software sends (I grepped for Downstream in the code, it's not there) so I presume it's from some middle box.
Does anyone recognize the message, what produces it, and why? There was indeed stuff messed up downstream, but why turn it into a mystery error message?
R's, John
PS: I wonder how long it'll take for someone to suggest unhelpful configuration changes on my host to fix the problem.
Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly
I've come across this error (or something very similar to it) before. I can't remember the exact product, but it turned out to be a transparent SMTP proxy somewhere in the path - possibly on a UTM firewall, but I could be wrong about that part... Not overly helpful I know, but might point you in the right direction... Scott On Sun, Jan 19, 2014 at 2:55 PM, John Levine <johnl@iecc.com> wrote:
I had some problems with incoming mail that I tracked down to a configuration bug, two hosts on the same LAN configured to respond to the IP address of the MX. It's fixed now.
While it was broken, attempts to send mail on some other systems got "421 Downstream server error." That is not a message that any of my mail software sends (I grepped for Downstream in the code, it's not there) so I presume it's from some middle box.
Does anyone recognize the message, what produces it, and why? There was indeed stuff messed up downstream, but why turn it into a mystery error message?
R's, John
PS: I wonder how long it'll take for someone to suggest unhelpful configuration changes on my host to fix the problem.
On 1/19/14, 5:32 PM, Scott Howard wrote:
I've come across this error (or something very similar to it) before. I can't remember the exact product, but it turned out to be a transparent SMTP proxy somewhere in the path - possibly on a UTM firewall, but I could be wrong about that part...
Not overly helpful I know, but might point you in the right direction...
Almost sounds like one of those annoying consumer Antivirus programs with the smtp/imap/pop3 proxies that wedge themselves in between mail client connections. Trying to remember what the error it was giving the other day on the machine I worked on, when the proxy itself had been blocked by the local system's firewall... I'd have been curious if you got the same error message trying to go out on 587 instead of 25. Thinking about it, that error screams of something like what a multi-server Exchange setup would say if something went wrong on the backend. Not entirely helpful either, but... never know. -- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org
I was thinking that maybe the rogue host configured on the IP didn't have any mail software installed and it was just a random service returning the error message as it didn't know how to handle the request. On Sunday, January 19, 2014, Brielle Bruns <bruns@2mbit.com> wrote:
On 1/19/14, 5:32 PM, Scott Howard wrote:
I've come across this error (or something very similar to it) before. I can't remember the exact product, but it turned out to be a transparent SMTP proxy somewhere in the path - possibly on a UTM firewall, but I could be wrong about that part...
Not overly helpful I know, but might point you in the right direction...
Almost sounds like one of those annoying consumer Antivirus programs with the smtp/imap/pop3 proxies that wedge themselves in between mail client connections.
Trying to remember what the error it was giving the other day on the machine I worked on, when the proxy itself had been blocked by the local system's firewall...
I'd have been curious if you got the same error message trying to go out on 587 instead of 25.
Thinking about it, that error screams of something like what a multi-server Exchange setup would say if something went wrong on the backend.
Not entirely helpful either, but... never know.
-- Brielle Bruns The Summit Open Source Development Group http://www.sosdg.org / http://www.ahbl.org
-- eSited LLC (701) 390-9638
participants (7)
-
Alexander Lopez -
Brielle Bruns -
Bryan Tong -
John Levine -
John R. Levine
-
Michael Brown -
Scott Howard