Skip to main content

Mail Loops and Bounces

Alex Panagides
Updated

Use this page when messages loop between your mail system and mxHERO, when senders get bounce messages, or when mxHERO rejects mail with an SMTP error. Most loops come from a missing or wrong loop-prevention exception or a missing Server value.

Check these first

  1. Compare the Transport Agent value. Open Settings › Gateway and copy the Transport Agent value. Your routing rule must add X-mxHero-Transport-Agent: <value> and must skip messages that contain X-mxHero-Server: <value>. Both use the same value.
  2. Check the exception header name. The exception must test X-mxHero-Server, not X-mxHero-Transport-Agent. mxHERO removes X-mxHero-Transport-Agent on entry, so an exception on that header never matches returned mail.
  3. Check the domain's Server field. In Settings › Organization and domains › Domains, every domain needs a Server (where mxHERO delivers inbound mail). See Domain Server and Relay Settings.
  4. Use explicit hosts. Point connectors and relay settings at smtp-in.mxhero.com (inbound) and smtp-relay.mxhero.com (outbound). Never use MX lookup toward a host whose MX points back to your own mail system.
  5. Read the bounce. Find the SMTP code and text in the bounce or in Reports › Email Flow Logs, then match it in the tables below.

How loop prevention works

Diagram: Your routing rule sends mail to mxHERO only when the X-mxHero-Server header is absent; mxHERO adds that header to everything it returns.

Your routing rule sends mail to mxHERO only when the X-mxHero-Server header is absent; mxHERO adds that header to everything it returns.

Loops

Symptom Cause Fix
Bounce 554 Message exceeded 50 hops, this may indicate an email loop. The message passed through more than 50 servers. mxHERO rejects it to stop the loop. Work through the checks below until the loop stops.
Loop on inbound mail in Microsoft 365 The mxHERO - Route Inbound transport rule has no exception for X-mxHero-Server, or the value does not match Settings › Gateway. Edit the rule: add the exception "header X-mxHero-Server matches <Transport Agent value>". See Office 365 Manual Configuration.
Loop on outbound mail in Microsoft 365 (outbound loopback) The mxHERO - Route Outbound rule has no exception, or the domain's Relay Server is not your tenant's MX host. Add the exception. Set Relay Server to <tenant>.mail.protection.outlook.com.
Loop in Google Workspace The content compliance rule does not skip messages with X-mxHero-Server, or the match type is wrong. In the rule, use the header match "Not contains text" for X-mxHero-Server with the exact Transport Agent value. Use explicit hosts, not MX records. See Google Workspace Configuration.
Inbound loop right after adding a domain The domain has no Server value (possible for domains created through the API). mxHERO then delivers inbound mail to the domain's public MX, which points back to mxHERO or to your routing rule. Set Server to your mail system's inbound host, for example <tenant>.mail.protection.outlook.com.
Loop when MX Lookup is on for the domain mxHERO resolves the Server's MX records. If they point back to mxHERO, mail loops. Turn off MX Lookup and enter the explicit inbound host.
Loop that started after you rotated the Transport Agent The routing rule adds the new value but the exception still tests the old value (or the reverse). Update both the header and the exception to the same value. Remove the previous value in Settings › Gateway only after every rule uses the new one.
mxHERO notifications or password emails are processed again Older behavior; mxHERO notifications now carry X-mxHero-Server and Auto-Submitted: auto-replied. Make sure your routing rule exception tests X-mxHero-Server.

Bounces and SMTP errors

Code or text Cause Fix
553 <rcpt> address unknown. The sending IP is not in your Allowed IP masks in Settings › Gateway. When the list has entries, mail from your organization's senders is accepted only from those IPs. Add the IP of the sending server, or clear the list.
550 Message rejected: invalid transport agent secret. A Gateway Secret is set, and the message's X-mxHero-Transport-Agent-Secret header is missing or wrong. Add the header with the current secret to your routing rules. When you rotate the secret, set a transition period so the previous secret keeps working while you update the rules. See Gateway Settings.
REJECT Relay access denied for sender <domain>. Please contact mxHERO support. The sender's domain belongs to an organization with no active subscription. Renew the subscription, or remove mxHERO from your mail flow. See Removing mxHERO from Mail Flow.
"Relay access denied" (temporary, 4xx) The recipient's domain is not registered or not active in mxHERO, and the sending client did not authenticate. Add and verify the domain in Settings › Organization and domains, or send outbound mail to smtp-relay.mxhero.com from an allowed connector or with SMTP-Auth credentials.
"User unknown in relay recipient table" Rcpt Lookup is on for the domain and the address is not a known account. Add the account (or sync your directory), or turn off Rcpt Lookup.
452 Requested action not taken: insufficient system storage. mxHERO is temporarily busy. The sending server retries automatically. No action needed. If it persists, check status.mxhero.com and contact support.
Sender gets [BOUNCED] <subject> from noreply@mxhero.com saying the attachments could not be processed A Protect Attachments, Secure Email or Zip Attachments rule is set to reject the message when the storage upload fails, and the upload failed. Fix the storage problem (Storage Upload Failures). To deliver the original instead, in the rule's More actions... panel set When the email could not be processed to Deliver anyway.
Sender gets "Delivery Status Notification (Failure)" from noreply@mxhero.com with the original attached mxHERO processed the message but could not hand it on for delivery after 5 attempts. Resend the message. If it repeats, contact support with the Email Flow Logs entry.
Normal non-delivery report from mxHERO's mail servers after about 24 hours The destination server (your Server or the recipient's MX) could not be reached. mxHERO retries for up to 24 hours. Check that the Server or Relay Server host is correct and accepts mail from mxHERO's IP addresses. See Network Endpoints and IP Addresses.
Email Flow Logs status Bounced or a delivery detail with a remote SMTP error The receiving server rejected the message after mxHERO delivered it. Read the relay and SMTP status in the recipient detail. The fix is on the receiving side (for example spam filtering or size limits).
Message over 256 MiB rejected mxHERO accepts messages up to 256 MiB. Your mail system's own limit is usually lower. Send large files as links instead.

Messages dropped on purpose

Some messages are not delivered by design. They show Dropped in Email Flow Logs:

  • Block Attachments matched. The sender gets an "Email blocked" notice.
  • A Temporary Hold or Request Approval item was cancelled, rejected or expired. After an extended hold expires, the message is rejected.
  • The message was sent to a Forwarding Address (@go.mail2cloud.io). These messages are saved and never delivered.

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk