550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)

albatroz

Well-Known Member
Mar 6, 2003
399
5
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
Recently, several emails coming from Office365 has started to bounce with the following error message
4/9/2020 6:15:52 PM - Server at SC1P215MB1135.LAMP215.PROD.OUTLOOK.COM returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError))'
4/9/2020 5:55:08 PM - Server at YY.YY.YY.YY (XX.XX.XX.XX) returned '450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError)'
 

albatroz

Well-Known Member
Mar 6, 2003
399
5
168
Virtual Orbis / Peru
cPanel Access Level
Root Administrator
Twitter
Something I discovered is that some of the IPs that were bounced were out of the IPs declared in this document published by Microsoft
That was the case of 20.180.141.18
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,255
313
Houston
Is the following enabled in the exim configuration?

Ratelimit suspicious SMTP servers

If so it sound like the servers aren't terminating the connection properly based on the error and the description for the setting:

Ratelimit incoming SMTP connections that do not send QUIT (violates RFCs), have recently matched an RBL, or have attacked the server.
But Microsoft also has some information on this in their own forums and I'd suggest reading it over prior to making any changes: '550 5.4.300 Message expired'
 

reddot

Member
Jan 14, 2008
7
0
51
I have the same problem too. I get complains from my customer once in a month or two. And always from Office 365 senders.

4/22/2020 10:21:34 AM - Server at VE1P191MB0910.EURP191.PROD.OUTLOOK.COM returned '550 5.4.318 Message expired, connection reset (SuspiciousRemoteServerError)(450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError))'
4/22/2020 10:00:50 AM - Server at mail.xxx.com (xxx.xxx.xxx.xxx) returned '450 4.4.318 Connection was closed abruptly (SuspiciousRemoteServerError)'

I could not find anything in my log. I have no idea why this is happening. Anyone can help?