Why isn't mail being delivered from my Email Security Gateway to my mail server?

Solution #00003514

Scope:
All Email Security Gateways, all firmware versions.

Answer:
If mail is not making it through to the mail server after being allowed by the Email Security Gateway, either the Email Security Gateway cannot communicate with the mail server, or the mail server is actively deferring or rejecting mail from the Email Security Gateway. If the messages are being deferred or the Barracuda cannot find the configured destination mail server, the outbound queue will begin to grow. If the mail server is blocking the messages from the Email Security Gateway, or accepting them and then not delivering to the recipient's inbox, then the mail server's configuration is most likely causing the issue.

If the outbound queue of the Email Security Gateway is growing, you should check the following things:

Make sure your mail server is up and responding over the SMTP port configured on the Email Security Gateway for that domain (usually port 25). If your mail server is down or unresponsive on the SMTP port, the Barracuda will not be able to send mail to it.
Make sure the Barracuda is able to resolve your mail server's domain properly with the DNS servers you have configured. If you are using internal DNS servers that will resolve your mail server's domain differently than external DNS servers would, you may need to go to the Basic > IP Configuration page of the Email Security Gateway's interface and change the Use Only These Servers? option to Yes. Alternatively, you can specify the destination server as an IP address, instead of a hostname, on the Domains > Domain Manager > Edit Domain page.

If, instead, the Basic > Message Log page shows Allowed messages as being Rejected, the mail server may be actively blocking email from the Email Security Gateway. In that case, you should check the following things:

Make sure that the mail server is configured to accept mail from the Email Security Gateway's IP address. For instance, on a Microsoft Exchange 2003 server, if someone has set up a Connection Filter you may need to explicitly allow the Barracuda's IP address as a valid sending IP address.
Use the Test SMTP Connection button on the Basic > IP Configuration page. To use the test, enter your destination server and a valid test email address and click the Test SMTP Connection button. This will load a pop-up window that displays the SMTP conversation the Email Security Gateway has with your mail server when it sends the test message. If your mail server is blocking the Email Security Gateway, the Test SMTP Connection test's output should help you troubleshoot the issue on your mail server.

Now, if the Basic > Message Log page shows the Allowed messages as being Delivered, this means that the destination mail server has accepted the messages from the Email Security Gateway. If the Delivery Status is Delivered, and the Delivery Detail shows a 250 SMTP response code, the destination mail server has signaled a successful message transfer to the Email Security Gateway. If the recipient does not receive the message in their mailbox, the mail server or other entity either blocked or redirected the message. If your mail server is doing some additional level of filtering, this might be why certain messages are not delivered to your users. When troubleshooting, you can try to redeliver lost messages from the Basic > Message Log page, as described in Solution #00001655.

Additional Notes:
For more information on Connection Filtering with Microsoft Exchange 2003, please visit this link:

http://support.microsoft.com/kb/823866

Link to This Page:
https://campus.barracuda.com/solution/50160000000HHCWAA4