MailHop Services and Cisco Firewalls

Recently, we have added a number of anti-spam features and made some large improvements to our MailHop services, resulting in smoother, faster delivery for our customers. However, it has come to our attention that older versions of some Cisco firewalls create problems with our servers, resulting in delivery issues.

The notable issue is a setting called "fixup protocol smtp", an option which (under normal circumstances) attempts to repair errors in SMTP communications, allowing mail delivery that may otherwise fail. Unfortunately, these older Cisco firewalls detect connections with our servers as "broken" and attempt to "repair" them, mangling the SMTP session in the process and preventing proper delivery.

If you are using a Cisco PIX or ASA firewall and use our MailHop services, please check to ensure that "fixup protocol smtp" is disabled and that you are using the most up-to-date version of the software available. To test this manually, please try a manual Telnet session with our mail servers (e.g. telnet mx1.mailhop.org 25) and note the results:

 <- 220 mx1.mailhop.org ESMTP MailHop by DynDNS.com
 -> EHLO mail.dyndns.com
 <- 250-mx1.mailhop.org
 <- 250-PIPELINING
 <- 250-SIZE 102400000
 <- 250-VRFY
 <- 250-ETRN
 <- 250-ENHANCEDSTATUSCODES
 <- 250-8BITMIME
 <- 250 DSN

This is a proper start to a normal SMTP session. However, if you are using a Cisco firewall, it may look more like this:

 <- 220 **1************ ***** ******* ** **********
 -> EHLO mail.dyndns.com
 <- 502 5.5.2 Error: command not recognized
 <- 421 4.7.0 mx1.mailhop.org Error: too many errors

If an error such as the above occurs, your firewall is likely the culprit and simply disabling "fixup protocol smtp" will usually resolve the issue.