Office 365 emails sent to my PMG our getting 550 5.4.316 Message expired, connection refused

Apr 22, 2020
2
0
21
51
I have recently installed PMG and have now put it into production. There our legit customers on Microsoft 365 that our sending my customers emails and they get the following bounce back: Server at SA9PR09MB5741.namprd09.prod.outlook.com returned '550 5.4.316 Message expired, connection refused(Socket error code 10061). The domain they are sending from doesn't even show up in the tracking center of PMG. I have port 25 wide open from the firewall to the PMG.

Any help would be appreciated.
 
check the mail log for message which contain outlook.com.

My first guess is that you have enabled greylisting, and that microsoft is sending the mails from different IPs each time (and it thus gets greylisted every time) - I would suggest one of the following options:
* disable greylisting completely (note that in our experience this does cause more spam to go through)
* leave it enabled but set a larger greylisting netmask (at least for v4 intially - you could try 19 or 20)

both can be set in GUI->Configuration->Mail Proxy->Options

I hope this helps!
 
I have a situation which appears very similar, but is there any explanation as to why the greylisting attempts would NOT show in the tracking center?
 
I have a situation which appears very similar, but is there any explanation as to why the greylisting attempts would NOT show in the tracking center?
one thing that comes to mind - is that you have to explicitly enable greylisting and NDR mails in the Tracking Center (there are 2 checkboxes) for them to be shown.

if this is not the case please provide a sample log of a greylisted e-mail which does not show up in the tracking center
 
one thing that comes to mind - is that you have to explicitly enable greylisting and NDR mails in the Tracking Center (there are 2 checkboxes) for them to be shown.

if this is not the case please provide a sample log of a greylisted e-mail which does not show up in the tracking center
My problem was actually Geo-IP-blocking in the router, the confusing part was this was also reporting 450 responses. So when they were 450 caused by the router the proxmox would never see it to log it.
 
ok - that explains it of course - glad you found the cause of the issue :)