I have been having problems receiving email from multiple domains over the past couple of weeks. On the initial complaints it appeared the problem was with the remote server. Basically after the RCPT TO the remote server would send an RSET. However, as the weeks have gone on I am seeing this all over the place. The initial domain I was having the problem with was facebook, but it only occured on new setup/password reset emails. Since, it is affecting many other large domains that I am sure are not the problem. 

 

Today I was setting up a users Galaxy 4. The user was on the WiFi and I got the same thing from his phone. All the settings are correct, and it is doing the same thing. Below is the log from this phone, but all of these look the same, with the exception that this user is actually authenticating!

 

It is simply happening too frequently and to too many domains to be the remote servers. I even had a conversation with one other vendor we work with and in their logs they see us timing out the conversation and never show their server sending the RSET.

 

I have disabled any anti-spam settings that were taking any significant time to respond.

 

 

[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 220 webmail.servicefoods.com
[2015.03.09] 15:38:18 [192.168.10.144][10005603] connected at 3/9/2015 3:38:18 PM
[2015.03.09] 15:38:18 [192.168.10.144][10005603] IP in whitelist
[2015.03.09] 15:38:18 [192.168.10.144][10005603] cmd: EHLO [192.168.10.144]
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 250-webmail.xxx.com Hello [192.168.10.144]250-SIZE 52428800250-AUTH LOGIN CRAM-MD5250-VRFY250-8BITMIME250 OK
[2015.03.09] 15:38:18 [192.168.10.144][10005603] cmd: AUTH LOGIN
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 334 VXNlcm5hbWU6
[2015.03.09] 15:38:18 [192.168.10.144][10005603] Authenticating as xxx@xxx.com
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 334 UGFzc3dvcmQ6
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 235 Authentication successful
[2015.03.09] 15:38:18 [192.168.10.144][10005603] Authenticated as xxx@xxx.com
[2015.03.09] 15:38:18 [192.168.10.144][10005603] cmd: MAIL FROM:<xxx@xxx.com>
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 250 OK <xxx@xxx.com> Sender ok
[2015.03.09] 15:38:18 [192.168.10.144][10005603] cmd: RCPT TO:<xxx@xxx.com>
[2015.03.09] 15:38:18 [192.168.10.144][10005603] rsp: 250 OK <xxx@xxx.com> Recipient ok
[2015.03.09] 15:38:19 [192.168.10.144][10005603] cmd: RSET
[2015.03.09] 15:38:19 [192.168.10.144][10005603] rsp: 250 OK
[2015.03.09] 15:38:48 [192.168.10.144][10005603] rsp: 421 Command timeout, closing transmission channel
[2015.03.09] 15:38:48 [192.168.10.144][10005603] disconnected at 3/9/2015 3:38:48 PM