Build 9540 connectivity problems - DO NOT UPGRADE!
Problem reported by Charalampos Michael - Today at 2:15 AM
Submitted
Windows Server 2025, upgraded and all my clients have connectivity problems, so careful!
Investigating the reason ,,,

update:
IDS is blocking server's ip for some reason ... getting error logins ... hmmm
[2026.02.16] 11:28:52.280 Error in login: username: xxxxxxxxxx, type: IMAP, Ip: xxxxxxxxx, host: xxxxxxxxxxxxxxx, logloginAttempt: True, recordLogin: True, impersonationLogin: False, returnDomainAlias: False, alwaysLogLoginAttemptsFromApi: True, appPasswordProtocols: Webmail
....
Exception in Login Check09, System performing conversions. Cannot get mailman.
....
IDS is still blocking server's external IP despite it's whitelisted ... lmao
...
Downgrading ....
....
Funny thing on test pc it 9540 works without problems ....
....
Downgraded to 5926 service is crashing ... nice ... restart
....
Restored Settings from backup and installed 5926 ...
Can not get mailman ... Failed to retrieve license and the service stops ... nice ...
,,,
Uninstall everything, restored only "Settings" folder from backup and re-installed 5918 which it had... The service starts and stops!
build 9540 changes something in data folders that makes older builds to crash!
Damn!
....
One server is broken from down/upgrade .... service restarts continuously. upgraded again to 5940 and restarted ... now seems to work but with the same problem.
On othe 9540 servers i whitelisted the external IP of the server and checked all them all ...  let's see
....
interesting
[2026.02.16] 13:38:21.400 Invalid time received from NtpClient.
[2026.02.16]    at MailService.Core.MailServer.PullOfficialTimeFromInternetAndUpdateOffset()
....
Seems it's randomly block users dispite IDS rules are disabled
...
1) Regenerated Let's Crypt SSL -> Nothing
2) Reset banding to None and the again to SSL -> Some clients connect
3) Tried unencrypted connection nothing.
4) Firewall down -> nothing
5) Restart router -> nothing
6) Check open ports -> they are open so mail server is listening

So something is blocking the connection, webmail works ok!
Superb!
Sébastien Riccio Replied
Same here pfff.

Upgraded to 9540 yesterday, and this morning MANY calls and tickets about connectivity issue.

So in emergency, I uninstalled 9540, re-installed 9526 but the service won't start.

I see in windows application event viewer, when 9526 tries to start:
"Version downgrade is not possible with this version of SmarterMail. Please run a newer version."

Incredible !!!!!!!!!!!!!!

I had to reinstall 9540 to have the service to start, but I'm not sure the connectivity/timeouts issue will be solved.
Sébastien Riccio System & Network Admin https://swisscenter.com
Charalampos Michael Replied
They NOT! i did noumerous times! Somebody do emergecy ticket to smartertools ... i am still investigating .... Trying to restore from backup ... i hope 9540 does not corrupt data folders 
Sébastien Riccio Replied
I noticed that the timeouts our customers are getting are maybe due to an unexpected amount of IDS triggered.
I usually have around 10-15 IP's blocked (mostly foreign country).

But with 9540 the IDS DDoS protection is blocking our customer IP addresses and a lot of them !
I removed the IDS rule to see if it helps running 9540 correctly ... 
Sébastien Riccio System & Network Admin https://swisscenter.com
Sébastien Riccio Replied
Interresting, when a user succesfully logs in, it adds it's IP to DoS blacklist:


[2026.02.16] 09:10:51.833 [a.b.c.d] IMAP Login successful: With user someuser@somedomain.ch
[2026.02.16] 09:11:30.731 [a.b.c.d] IMAP Attempting to login user: somedomain@somedomain.ch
[2026.02.16] 09:11:30.731 [a.b.c.d] IMAP Login successful: With user somedomain@somedomain.ch
[2026.02.16] 09:13:51.586 [a.b.c.d] SMTP Login successful: For user somedomain@somedomain.ch
[2026.02.16] 09:15:40.638 DenialOfService [DenialOfService a.b.c.d] Added IP to IDS block list. Duration: 1799,9979497 seconds, Description: Default DoS rule
[2026.02.16] 09:46:17.667 [a.b.c.d] IMAP Attempting to login user: somedomain@somedomain.ch
[2026.02.16] 09:46:17.667 [a.b.c.d] IMAP Login successful: With user somedomain@somedomain.ch
[2026.02.16] 09:48:05.268 DenialOfService [DenialOfService a.b.c.d] Added IP to IDS block list. Duration: 1799,9977592 seconds, Description: Default DoS rule
[2026.02.16] 10:22:15.481 [a.b.c.d] IMAP Attempting to login user: somedomain@somedomain.ch
[2026.02.16] 10:22:15.481 [a.b.c.d] IMAP Login successful: With user somedomain@somedomain.ch
[2026.02.16] 10:23:59.139  DenialOfService [DenialOfService a.b.c.d] Added IP to IDS block list. Duration: 1799,9978737 seconds, Description: Default DoS rule
[2026.02.16] 10:54:25.865 [a.b.c.d] IMAP Attempting to login user: someuser@somedomain.ch
[2026.02.16] 10:54:25.865 [a.b.c.d] IMAP Login successful: With user someuser@somedomain.ch
[2026.02.16] 10:54:45.461 [a.b.c.d] IMAP Attempting to login user: someuser@somedomain.ch
Sébastien Riccio System & Network Admin https://swisscenter.com
Charalampos Michael Replied
Even if you whitelist his IP, i wonder if we can disable IDS for the moment.
Sébastien Riccio Replied
I removed the IDS rule for DDoS (there is no way to disable it, only delete) and removed all blacklisted IPs.
We're waiting for customer feedback...
Sébastien Riccio System & Network Admin https://swisscenter.com
Charalampos Michael Replied
i did that nothing changed
Charalampos Michael Replied
seems binding problerms ... i regenerated the SSL nothing.

14:52:03.157 System.Threading.Tasks.TaskCanceledException: A task was canceled.
   at SmarterMail.Protocols.Common.PooledTcpServer.Listener()
14:52:13.418 [fe80::a1f8:e2b7:622b:f07c%3:993] Binding(2) Exception: System.Net.Sockets.SocketException (10049): The requested address is not valid in its context.
   at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, Boolean disconnectOnFailure, String callerName)
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at SmarterMail.Protocols.Common.PooledTcpServer.StartListening(IPEndPoint a, db_system_binding_port b)
14:53:27.959 System.Threading.Tasks.TaskCanceledException: A task was canceled.
   at SmarterMail.Protocols.Common.PooledTcpServer.Listener()
14:53:39.082 [fe80::a1f8:e2b7:622b:f07c%3:993] Binding(2) Exception: System.Net.Sockets.SocketException (10049): The requested address is not valid in its context.
   at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, Boolean disconnectOnFailure, String callerName)
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at SmarterMail.Protocols.Common.PooledTcpServer.StartListening(IPEndPoint a, db_system_binding_port b)


Christian Schmit Replied
Same here. We have temporarily deleted the IDS DDoS protection rule for now.
Bruce Replied
We encountered the DoS issue immediately on Saturday and had to delete the rule. However, we are now also receiving reports about IMAP connectivity problems.
J. LaDow Replied
Addresses with fe80: prefix are link-local addresses in Windows servers -- on our server (9526 and for the two years prior on our previous build) - we've never bound SM ports/protocols to link-local.

Try only binding to your localhost (127.0.0.1 / 0::) and your public / "actual" internal IPs and see what happens --



RE: IDS changes:
Additionally, we had noticed a behavior change when landing on 9526 with IDS and NTLM that was adding IDS entries before throttling with IMAP connections kicked in - and was causing users who previously never had issues. We were told that IDS logic was added between our old version (8657) and the 9526, but our old version had IDS on IMAP, would catch bad NTLM inputs and not add them to the IDS to the point where users were getting locked out with successful logins. That is a different issue, but still a problem none the less.
MailEnable survivor / convert --
Charalampos Michael Replied
1) Regenerated Let's Crypt SSL -> Nothing
2) Reset banding to None and the again to SSL -> Some clients connect
3) Tried unencrypted connection nothing.

So something is blocking the connection

Now i get these so i guess they have problems with their code guys, you can't fix it unless they publish an update! The sad thing is that you can't revert to old builds with service is crashing!

[2026.02.16] 15:11:59.214 [IP Unknown][11952267][993] Could not negotiate SSL session: Received an unexpected EOF or 0 bytes from the transport stream.
[2026.02.16] 15:16:49.458 [IP Unknown][1088956][993] Could not negotiate SSL session: Received an unexpected EOF or 0 bytes from the transport stream.
[2026.02.16] 15:18:58.931 [IP Unknown][8420316][993] Could not negotiate SSL session: Received an unexpected EOF or 0 bytes from the transport stream.
[2026.02.16] 15:19:25.465 System.Threading.Tasks.TaskCanceledException: A task was canceled.
[2026.02.16]    at SmarterMail.Protocols.Common.PooledTcpServer.Listener()
[2026.02.16] 15:19:34.787 [fe80::a1f8:e2b7:622b:f07c%3:993] Binding(2) Exception: System.Net.Sockets.SocketException (10049): The requested address is not valid in its context.
[2026.02.16]    at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, Boolean disconnectOnFailure, String callerName)
[2026.02.16]    at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
[2026.02.16]    at System.Net.Sockets.Socket.Bind(EndPoint localEP)
[2026.02.16]    at SmarterMail.Protocols.Common.PooledTcpServer.StartListening(IPEndPoint a, db_system_binding_port b)
[2026.02.16] 15:19:51.820 [IP Unknown][61909267][993] Could not negotiate SSL session: Received an unexpected EOF or 0 bytes from the transport stream.
[2026.02.16] 15:20:27.459 [IP Unknown][62710127][993] Could not negotiate SSL session: Received an unexpected EOF or 0 bytes from the transport stream.
Tan Replied
I have 2 user reporting email sent but not saved inside the sent folder. Today is technically non working day due to upcoming public holiday

Anyone else has such report? I suspect could it be due to ddos too?

Reply to Thread

Enter the verification text