When receiving an email message, the SMTP service will either wait until it receives the terminating sequence "<CRLF>.<CRLF>", or it times out. If it times out, there would be indication of this in the SMTP Debug log, for example:
04/25/12 23:45:11 ME-E0070: (recv) socket  error during [DATA] command from host XX.XX.XX.XX. Socket was disconnected - Error: (10060)
This will not appear immediately after the DATA logging time, instead it will be after the timeout time. These events are normal for the mail server, as clients may have sends disconnect during large emails due to a network problems, cancelling the send, etc. You may also see this if the sender is not correctly using SMTP. This is possible for web site scripts, automated sending applications, etc. It is also possible that the mail server never receives the terminating sequence due to a faulty router or firewall. Some Cisco devices have had this problem.
Since the problem is due to the sending application or network configuration, you don't need to make any changes in the mail server software. The full SMTP inbound conversation can be logged, which may help indicate whether it receives the terminating sequence, and this data may be useful to the sender. To do this the following Windows registry key need to be added:
For 64bit Windows versions:
For 32bit Windows versions:
You will need to restart the SMTP service for this change to take effect. The details are added to the SMTP Debug log. Caution: This will generate very large log files, so you should only enable this for a short time and check the growth of the file.
|Product:||MailEnable (All Versions)|
|Class:||TRB: Troubleshooting (Configuration or Environment)|
|Revised:||Wednesday, May 4, 2016|