Problem with some incoming mails

[bkova]

We use Ironport for Antispam and Antivirus in front of our Ability mail server v 3.1.0 which forward all mails to our SMTP.
From yesterday we have problem with some domains (servers in case gmail -some gmails are coming some not depends on gmail server IP) that mails are not received in Ability but sender or receiver do not get any info about that mail.
In log we found that comunication for some mails are RESET but we can't figure out why -we also disabled Aspam AV and Sandbox on Ironport but without success.
example of unsucssessfull sending:
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[220 webmail.mydomain.com ESMTP (Code-Crafters Ability Mail Server 2012)]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[EHLO mx01.xyz.com]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> Success: Action=[Received Hello], Details=[Host=mx01.xyz.com]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-webmail.mydomain.com]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-PIPELINING]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-8BITMIME]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-AUTH PLAIN LOGIN CRAM-MD5 CRAM-SHA1]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-STARTTLS]
Mon, 04 Jan 2016 17:17:15 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 OK]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[MAIL FROM:<xx.yy@gmail.com>]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> Success: Action=[Received Sender], Details=[xx.yy@gmail.com]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 Email address accepted. <xx.yy@gmail.com>]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[RCPT TO:<ttyy@mydomain.com>]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> Success: Action=[Received Recipient], Details=[tttyy@mydomain.com]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 Email address accepted. <ttyy@mydomain.com>]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[rset]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> Success: Action=[Reset Transaction States]
Mon, 04 Jan 2016 17:17:16 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 Reset transaction states.]
Mon, 04 Jan 2016 17:17:21 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[QUIT]
Mon, 04 Jan 2016 17:17:21 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[221 Thank you and good bye.]
Mon, 04 Jan 2016 17:17:21 -> 123.345.567.81 -> Success: Action=[Close Connection]


In other case if i send mail to particular problematic gmail acount and then on Gmail acount make reply then mail pass OK
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> Success: Action=[Accept Connection], Details=[Port 25]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[220 webmail.mydomain.com ESMTP (Code-Crafters Ability Mail Server 2012)]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[EHLO mx01.xyz.com]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> Success: Action=[Received Hello], Details=[Host=mx01.xyz.com]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-webmail.mydomain.com]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-PIPELINING]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-8BITMIME]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-AUTH PLAIN LOGIN CRAM-MD5 CRAM-SHA1]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250-STARTTLS]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 OK]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[MAIL FROM:<xx.yy@gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> Success: Action=[Received Sender], Details=[xx.yy@gmail.com]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 Email address accepted. <xx.yy@gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[RCPT TO:<ttyy@mydomain.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> Success: Action=[Received Recipient], Details=[ttyy@mydomain.com]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[250 Email address accepted. <ttyy@mydomain.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[DATA]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> Success: Action=[Start Mail Transaction]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Sent Command], Details=[354 Please send the data and end with a <CRLF>.<CRLF>.]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[IronPort-PHdr: =?us-ascii?Q?9a23=3ACcRMbx=31D5QB7E=30qhsmDT=2BDRfVm=30co7zxezQtwd8Z?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?segXLfad9pjvdHbS=2Be9qxAeQG96Eu7QZ=30KGP7ujJYi8p39WoiDg6aptCVhs?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?I24=309vjcLJ4q7M3D9N=2BPgdCcgHc5PBxdP9nC=2FNlVJSo6lPwWB6lX7=31zMZGw?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?3=2BOAxpPay=31X9eK=314Xkn9y=31rqHUZgRTgDOjVo9oKxqsqQTa=2Fp=30KnZFlJbw=31y?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?xDhoXxWcuJXzmouJUjFzDjm4cLlwJlm8j9Usuxpy9RHXr=2F=2Bfq9wGaBfCTU9?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?N2krotHxshbZSQqEznQZW2QS=31BFPBl6Wv=31nBQp7tv36i5aJG=30y6AMJizFOh?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?sVA=3D=3D?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-IronPort-Anti-Spam-Filtered: true]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-IronPort-Anti-Spam-Result: =?us-ascii?Q?A=30E=31BQBQmopW=2F6ygVdFbgkNDUlyDAbc?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?thXYCgRYHFgEBAQEBAQF6gj43ASkCGBMlAQEaAQEBAwUBDBECCRIBCBMGAQ?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?EWAwELBgULAw8BAQEiAgICBRABBQQBAQMOAQUBHAYSAQYch3UBAxEFoys9M?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?YssgWuCd4o6ChknDVSBdQEBAQEBAQQBAQEBAQEBARQBBQ6NPIINFgyCaIFB?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?BYkZhB=2BDOAGBCYMxgUOBDIJdh3yCF4FtEiOBDAkiggYWgVE9MIJDAQEB?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-IPAS-Result: =?us-ascii?Q?A=30E=31BQBQmopW=2F6ygVdFbgkNDUlyDAbcthXYCgRYHFgEBA?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?QEBAQF6gj43ASkCGBMlAQEaAQEBAwUBDBECCRIBCBMGAQEWAwELBgULAw8B?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?AQEiAgICBRABBQQBAQMOAQUBHAYSAQYch3UBAxEFoys9MYssgWuCd4o6Chk?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?nDVSBdQEBAQEBAQQBAQEBAQEBARQBBQ6NPIINFgyCaIFBBYkZhB=2BDOAGBCY?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ =?us-ascii?Q?MxgUOBDIJdh3yCF4FtEiOBDAkiggYWgVE9MIJDAQEB?=]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-IronPort-AV: E=Sophos;i="5.20,521,1444687200"; ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ d="gif'147?scan'147,208,147";a="1912950"]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-Amp-Result: Clean]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-Amp-Original-Verdict: file unknown]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-Amp-File-Uploaded: False]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Received: from mail-yk0-f172.google.com ([209.85.160.172]) by ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ mx01.xyz.com with ESMTP; 04 Jan 2016 17:11:42 +0100]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Received: by mail-yk0-f172.google.com with SMTP id a85so175007475ykb.1 ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ for <ttyy@mydomain.com>; Mon, 04 Jan 2016 08:18:46 -0800 (PST)]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ s=20120113; ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ h=mime-version:in-reply-to:references:date:message-id:subject:from:to ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ :content-type; bh=q7GANjkCW4DZ48CqjhfWQci9Wb68c9EvePVAZYOjaMM=; ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ b=S5NjJn9u0Px0W3hI519AsalatkDJ/pobRcxZZOe5hELEvxQC0wEdI4qQAGcSXmAI2M ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ jpWaB5KsRLDK5sulpS0ltznaEHL8YewTXUG5nwIwDwmR+Ft7vtFvGRwpWS6aLOpIyygP ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ HwtR/7yZn0fIHfaBH9Y0JKL1+3gjpI6OcZaaL6QnbWEBcgzHDaucrP7TVFV5Mqzjq8oT ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ qggneeNmix2FBsn8gUoWQqIiL1/e25UOYw97U2iqgc128ptYg2g5BMZ+seSutywFhP0K ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ pn2a2Jnaznb90p/o1uhk9o/C5SPtynIdndVhfz/0TouWpTWvBac5jzb+8dnwYI3gdTAJ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ cr0A==]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[MIME-Version: 1.0]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-Received: by 10.13.224.132 with SMTP id ]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ j126mr62617052ywe.99.1451924325917;Mon, 04 Jan 2016 08:18:45 -0800 (PST)]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Received: by 10.129.55.136 with HTTP; Mon, 4 Jan 2016 08:18:45 -0800 (PST)]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[In-Reply-To: <CAH02sG9soEFTrOzoqPVcR2RO9gre_Ht3rjbfv4JQsxhAVc1+aA@mail.gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[References: <009401d146f1$40205b20$c0611160$@hr><CAH02sG8utm42kHBqe-Wx=d9a=h]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ Oj5mbQVE3hY5Wg2H8-hn1r_Q@mail.gmail.com><CAH02sG9soEFTrOzoqPVcR2RO9gre_Ht3rjbfv4JQsxhAVc1+aA@mail.gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Date: Mon, 4 Jan 2016 17:18:45 +0100]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Message-ID: <CAH02sG_EXK4Gw+nCwYOHNtgA=TXCx-5rWN6kc_GREoYVUUbZBA@mail.gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Subject: Re: tt]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[From: xx yy <xx.yy@gmail.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[To: =?UTF-8?Q?xx_dfdfdd=C4=87?= <ttyy@mydomain.com>]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Content-Type: multipart/related;]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[ boundary=94eb2c05f7dcb006be0528847979]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-TM-AS-Product-Ver: CSC-0-7.5.1018-21410]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[X-TM-AS-Result: No--10.80-5.00-31-1]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[--94eb2c05f7dcb006be0528847979]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Content-Type: multipart/alternative; boundary=94eb2c05f7dcb006bb0528847978]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[--94eb2c05f7dcb006bb0528847978]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Content-Type: text/plain; charset=UTF-8]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command], Details=[Content-Transfer-Encoding: quoted-printable]
Mon, 04 Jan 2016 17:18:47 -> 123.345.567.81 -> ***DEBUG*** -> Success: Action=[Recv Command]

We are also contacting Cisco for Ironport support but in meantime we also want to check with You if You have some suggestions.
regards

[Code Crafters]

The logs show that sender / recipients are successfully received then, for no shown reason, the client (Ironport) issues an RSET and QUIT. You'll have to wait for them to confirm more details of why this can happen.

See below for explanation of RSET command from SMTP RFC 2821:

4.1.1.5 RESET (RSET)

This command specifies that the current mail transaction will be
aborted. Any stored sender, recipients, and mail data MUST be
discarded, and all buffers and state tables cleared. The receiver
MUST send a "250 OK" reply to a RSET command with no arguments. A
reset command may be issued by the client at any time. It is
effectively equivalent to a NOOP (i.e., if has no effect) if issued
immediately after EHLO, before EHLO is issued in the session, after
an end-of-data indicator has been sent and acknowledged, or
immediately before a QUIT. An SMTP server MUST NOT close the
connection as the result of receiving a RSET; that action is reserved
for QUIT (see section 4.1.1.10).

Since EHLO implies some additional processing and response by the
server, RSET will normally be more efficient than reissuing that
command, even though the formal semantics are the same.

There are circumstances, contrary to the intent of this
specification, in which an SMTP server may receive an indication that
the underlying TCP connection has been closed or reset. To preserve
the robustness of the mail system, SMTP servers SHOULD be prepared
for this condition and SHOULD treat it as if a QUIT had been received
before the connection disappeared.

Syntax:
"RSET" CRLF