MailMarshal SMTP is processing e-mail very slowly

This article applies to:

• Trustwave MailMarshal (SEG)

Symptoms:

• Trustwave MailMarshal (SEG) is processing e-mail very slowly.
• Typically mail flows normally, but intermittently there are extended delays in mail delivery.
• When connecting with Telnet to port 25 on the MailMarshal server, there is no response to the initial connection attempt. It may time out or eventually give a response after a long wait.
• In the Console mail servers or services nodes, there may be multiple <Unknown> entries for the receiver and sender, and the 'Active Threads' field may never regress to zero.

Causes:

Unresponsive reputation services (DNS blocklists) are enabled.  

• In version 6.2 and below, check for DNS Blocklists enabled in the Host Validation tab of Server Properties, but not used in any enabled rules.
• In version 6.4 and above, check the Reputation Services item in the main tree of the Configurator.

Some very old default configurations that may have been preserved through upgrades have invalid DNS Blocklist (reputation service) entries.  If the ORBS, Osirusoft or Dorkslayers lists are enabled, then e-mail will be slow to process, and some end users may not received e-mail. This is because these services are no longer operating. 

Also, if the MAPS or Spamhaus reputation services are enabled and no subscription has been purchased from the third party, then you can see the same problems with processing. 

With the old configurations, there may also static be entries in the UserDefined.XML script to the same reputation service sites, which can cause slow processing in the engine. 

Reply:

To fix slow processing due to inoperative reputation services, remove the services from any rules. Then disable the services in Server Properties | Host Validation (version 6.2 and below).

Note: This workaround depends on at least one of the configured services continuing to be available. You should review currently available services, and if necessary add new ones to the list.

1. Open MailMarshal Configurator or Management Console.
2. Expand Email Policy.
3. Locate any Connection (Receiver) rules that use the the Where senders IP address is listed in condition.
4. Click the DNS BlackList link in the Where senders IP address is listed in condition.
5. Remove the unwanted blocklists. If the rule only uses one blocklist and it is unwanted, disable or delete the rule.
6. Expand Policy Elements | Reputation Services.
7. Remove any unwanted items from the list.
8. Disable the services in Server Properties | Host Validation (version 6.2 and below).
9. Commit configuration.

To comment out or delete the entries in the .XML scripts, follow these steps:

1. To delete or comment the particular lines out, go to the Config folder in the MailMarshal install location.
   
   • For full details of the location for each version, see article Q10832.
2. Open the UserDefined.xml script in a text editor (e.g. Notepad).
3. Go to the Evaluations section and either delete the line entries for the particular reputation service site (e.g. ORBS and MAPS), or comment the lines out using normal HTML comment tags (i.e. <!-- and -->).
4. As a precaution, you should back up any scripts that you have made changes to, to a backup location or media.

This article was previously published as:

NETIQKB34632