550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)

albatroz

Well-Known Member
Mar 6, 2003
401
6
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
Recently, several emails coming from Office365 has started to bounce with the following error message
4/9/2020 6:15:52 PM - Server at SC1P215MB1135.LAMP215.PROD.OUTLOOK.COM returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError))'
4/9/2020 5:55:08 PM - Server at YY.YY.YY.YY (XX.XX.XX.XX) returned '450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError)'
 

albatroz

Well-Known Member
Mar 6, 2003
401
6
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
Something I discovered is that some of the IPs that were bounced were out of the IPs declared in this document published by Microsoft
That was the case of 20.180.141.18
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,296
1,271
313
Houston
Is the following enabled in the exim configuration?

Ratelimit suspicious SMTP servers

If so it sound like the servers aren't terminating the connection properly based on the error and the description for the setting:

Ratelimit incoming SMTP connections that do not send QUIT (violates RFCs), have recently matched an RBL, or have attacked the server.
But Microsoft also has some information on this in their own forums and I'd suggest reading it over prior to making any changes: '550 5.4.300 Message expired'
 

reddot

Member
Jan 14, 2008
7
0
51
I have the same problem too. I get complains from my customer once in a month or two. And always from Office 365 senders.

4/22/2020 10:21:34 AM - Server at VE1P191MB0910.EURP191.PROD.OUTLOOK.COM returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError))'
4/22/2020 10:00:50 AM - Server at mail.xxx.com (xxx.xxx.xxx.xxx) returned '450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError)'

I could not find anything in my log. I have no idea why this is happening. Anyone can help?
 

RSL

Registered
Apr 21, 2021
2
0
1
Spain
cPanel Access Level
Root Administrator
I have the same problem too from Office 365 senders when are multiple recipients.

Server at DBBP189MB1193.EURP189.PROD.OUTLOOK.COM returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError))'
Server at mail.xxxxxxxx.com (xx.xx.xx.xx) returned '450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError)'

With a one recipient, the e-mails are received.

Disable Ratelimit suspicious SMTP servers does not solve this problem.

Any idea?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,418
1,001
313
cPanel Access Level
Root Administrator
Could you try disabling the "Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam" setting in WHM >> Exim Configuration Manager? I've seen that cause similar issues in the past.

You could also try adding the IPs listed at Office 365 URLs and IP address ranges - Microsoft 365 Enterprise to /etc/trustedmailhosts to see if that takes care of things and lets the mail get through properly.
 

RSL

Registered
Apr 21, 2021
2
0
1
Spain
cPanel Access Level
Root Administrator
Hi, disabling the "Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam" setting in WHM >> Exim Configuration Manager, has worked for me.

Thank's cPRex