When mail stops leaving an Exchange server, the queue's LastError usually tells you why, but in a compressed form: an SMTP code, a socket error, a remote server's reply in quotes or just a queue state. This quick reference decodes the LastError texts and queue states admins meet on Exchange Server SE, 2019 and 2016: what each means, the usual cause and the first check, with links to the detailed guides.
Codes in this quick reference
441 4.4.1 Error encountered while communicating with primary target IP address: the connection to the next hop failedGet-Queue LastError / Queue ViewerFailed to connect. Winsock error code: 10060, Win32 error code: 10060.Get-Queue LastErrorAttempted failover to alternate host, but that did not succeed.Get-Queue LastErrorEither there are no alternate hosts, or delivery failed to all alternate hosts.Get-Queue LastError451 4.4.0 Error encountered while communicating with primary target IP address: "421 4.4.2 Connection dropped due to SocketError."Get-Queue LastErrorWinsock error code: 10061 WSAECONNREFUSED: the target computer actively refused the connectionGet-Queue LastError (Failed to connect)Winsock error code: 10054 WSAECONNRESET: connection reset by peer (forcibly closed by the remote host)Get-Queue LastError (Failed to connect)Winsock error code: 10053 WSAECONNABORTED: software caused connection abort on the local hostGet-Queue LastError (Failed to connect)
+ 27 more codes in the tables below.
How to read a LastError#
- Where:
Get-Queueshows the queue's last error,Get-Messagethe error for each message, and Queue Viewer in the Exchange Toolbox shows both in the Last Error column. - "Error encountered while communicating with primary target IP address": the connection itself failed. The quoted text gives a Winsock code or a socket error.
- "Primary target IP address responded with": the remote server answered, and the text in quotes is its SMTP reply. Look that reply up, on the receiving side.
- "Attempted failover to alternate host": Exchange already tried the other MX hosts, addresses or smart hosts. On recent builds the text is often wrapped in fields such as
{LED=...}(the error) and{FQDN=...}(the host). - Time pressure: by default senders get a delay notice after four hours and an NDR after two days, so read LastError early.
PowerShell
Get-Queue -Server EX01 | Where-Object { $_.MessageCount -gt 0 } |
Format-Table Identity, DeliveryType, Status, MessageCount, Velocity, NextHopDomain -AutoSize
Get-Queue -Identity "EX01\fabrikam.com" |
Format-List DeliveryType, NextHopDomain, Status, LastError, LastRetryTime, NextRetryTime
Get-Message -Queue "EX01\fabrikam.com" | Format-Table FromAddress, Status, RetryCount, LastError -AutoSize
Get-QueueDigest -Dag DAG01Get-QueueDigest summarizes queues across servers; by default it lists delivery queues with ten or more messages.
Connection failures#
| LastError | Meaning | Usual cause | First check |
|---|---|---|---|
441 4.4.1 Error encountered while communicating with primary target IP address | Exchange couldn't hold an SMTP connection with the next hop | Outbound port 25 blocked, remote host down, smart host unreachable | Test-NetConnection <IP> -Port 25 from each source server (441 guide) |
Failed to connect. Winsock error code: 10060, Win32 error code: 10060. | The TCP connection timed out: nothing answered | Firewall, NAT or provider blocking port 25, or the host is down | The same test from outside your network |
Attempted failover to alternate host, but that did not succeed. | The other MX hosts, addresses or smart hosts failed too | All targets share one problem, often your own egress | Test each target address |
Either there are no alternate hosts, or delivery failed to all alternate hosts. | No other target existed, or every one failed | One smart host or one MX record | Add a second smart host where you control routing |
451 4.4.0 Error encountered while communicating with primary target IP address: "421 4.4.2 Connection dropped due to SocketError." | The connection opened but broke during the session | TLS negotiation, firewall SMTP inspection, MTU problems on large messages | Send protocol log (protocol logging guide) |
Winsock codes in "Failed to connect"#
| Code | Meaning (Microsoft) | Usual cause in a queue | First check |
|---|---|---|---|
10061 WSAECONNREFUSED | Connection refused: the target actively refused it, usually because nothing is listening | Remote SMTP service stopped, wrong connector port, or a device rejecting port 25 | Test-NetConnection to that port; the connector's Port |
10054 WSAECONNRESET | Connection reset by peer: the remote host forcibly closed it | Remote restart, or a firewall or IPS cutting the session | The protocol log step where it resets |
10053 WSAECONNABORTED | Software on this server aborted the connection, possibly after a time-out or protocol error | Local time-outs or security software | A small test message; local security software |
10051 WSAENETUNREACH | Network is unreachable: no known route | Missing default gateway or route, VPN down | Get-NetRoute -DestinationPrefix 0.0.0.0/0 |
10065 WSAEHOSTUNREACH | No route to host | Routing to that one host | Test-NetConnection <IP> -TraceRoute |
10050 WSAENETDOWN | Network is down: the stack, interface or local network failed | NIC or network failure on the server | Adapter status; System log |
10013 WSAEACCES | Permission denied: socket access forbidden by its access permissions | A local firewall rule or security product blocking outbound SMTP | Host firewall and antivirus rules for port 25 |
Remote replies: "Primary target IP address responded with"#
| LastError | Meaning | Usual cause | First check |
|---|---|---|---|
451 4.4.0 Primary target IP address responded with: "421 4.4.1 Connection timed out." | The session with the next hop timed out | Microsoft documents a TLS certificate not enabled for SMTP; the send log shows TLS negotiation failed with error UnknownCredentials | Get-ExchangeCertificate | fl Thumbprint,Services |
451 4.4.0 Primary target IP address responded with: "454 4.7.0 Temporary authentication failure." | Another Exchange server refused Exchange authentication | Clocks more than 5 minutes apart, AD replication, SMTPSVC SPN problems, blocked Kerberos ports | setspn -L <server>; setspn -X; time on servers and DCs |
Event ID 1035: Inbound authentication failed with error IllegalMessage for Receive connector | The receiving server's side of the 454 4.7.0 failure (mechanism ExchangeAuth) | As above, or Exchange authentication off on the receive connector | Get-ReceiveConnector | fl Identity,AuthMechanism |
421 4.3.2 The maximum number of concurrent server connections has exceeded a per-source limit, closing transmission channel | The receiving Exchange server hit its per-source connection limit | One server or gateway opening many parallel sessions | MaxInboundConnectionPerSource on the receiving connector (gateway guide) |
421 Exceeded allowable connection time, disconnecting. | A Cisco Secure Email Gateway public listener closed the session at its total connection time limit | Exchange relaying through a public listener, which applies these timers | Relay through a private listener where the model has one (Cisco guide) |
421 Timed out waiting for successful message injection, disconnecting. | The public listener closed a connection that hadn't delivered a message in time | Slow or stalled sessions through a public listener | The same listener choice; the protocol log for slow sessions |
Routing, DNS and special queues#
| LastError or queue | Meaning | Usual cause | First check |
|---|---|---|---|
DNS query failed with error InfoNoRecords | DNS returned no records of the type transport needed | A domain without usable MX or A records, or an internal zone shadowing it | Resolve-DnsName <domain> -Type MX (DNS guide) |
Unreachable queue (Unreachable Domain) | Messages that can't be routed to their destination | Configuration changes to the routing path: a removed connector, address space or domain | Recent connector changes; messages resubmit when configuration updates arrive, unless the queue is suspended |
Poison message queue (Poison Message) | Messages judged harmful after a crash; never resumed or expired automatically | Transport crashing on a message or a faulty agent | Application log crashes (poison guide) |
Submission queue (Submission) growing | Accepted messages waiting for the categorizer | Categorization stalled: back pressure, agents, directory access | Event ID 15004; Get-TransportAgent |
Shadow queue (ShadowRedundancy) growing | Redundant copies held until the primary server delivers | The primary server named in NextHopDomain is down or slow | That server's queues |
Queue states and delivery types#
| Value | Meaning | Usual cause | First check |
|---|---|---|---|
Status: Retry | The last connection attempt failed; the queue waits to retry | Whatever LastError says | NextRetryTime; Retry-Queue after a fix |
Status: Suspended | Suspended by an administrator; messages stay until resumed | Maintenance or troubleshooting left unfinished | Resume-Queue |
Status: Connecting that doesn't clear | The queue is still connecting to the next hop | Slow or filtered connections | The 441 checks above |
Velocity below 0, growing MessageCount | Messages arrive faster than they leave | A slow or failing next hop | IncomingRate and OutgoingRate |
DnsConnectorDelivery in Retry | External domain reached through MX lookups | DNS or port 25 problems | LastError; DNS and 441 guides |
SmartHostConnectorDelivery in Retry | The smart hosts in NextHopDomain aren't accepting mail | Smart host down, or authentication or TLS mismatch | Connectivity and the smart host's logs |
SmtpDeliveryToMailbox growing | Delivery to the mailbox database named in NextHopDomain is stalled | Database dismounted or failing over, or a delivery service problem | Get-MailboxDatabaseCopyStatus; Get-Service MSExchangeDelivery |
SmtpRelayToDag / SmtpRelayToRemoteActiveDirectorySite in Retry | An internal hop to another DAG or AD site fails | WAN or firewall between sites, or Exchange authentication (454 4.7.0) | Test-NetConnection <server> -Port 25 |
SmtpRelayWithinAdSiteToEdge in Retry | The hop to the Edge Transport server fails | Edge unreachable, EdgeSync or certificate problems | EdgeSync guide |
SmtpRelayToConnectorSourceServers in Retry | The Send connector's source server is another server, and it isn't reachable | That server down or refusing connections | The connector's source servers |
SmtpRelayToServers in Retry | Messages for a distribution group with a specific expansion server, named in NextHopDomain | The expansion server is down or retired | Get-DistributionGroup | fl Name,ExpansionServer |
Message PendingRemove / PendingSuspend | Removed or suspended by an administrator while in transmission | Normal after Remove-Message or Suspend-Message | Wait for the transmission attempt to end |
Related errors with their own guides#
451 4.4.0 DNS query failedandSMTPSEND.DNS.NonExistentDomain: DNS query failed guide.452 4.3.1 Insufficient system resourcesfrom another Exchange server: back pressure guide.454 4.7.5TlsCertificateName not found: Event ID 12014 guide.- Expiry (
4.4.7) and other status codes: NDR quick reference; replies from Mimecast, Barracuda or FortiMail: gateway rejection codes.
How to verify a fix#
- Force a new attempt instead of waiting:
Retry-Queue, with-Resubmit $trueif you changed routing. Get-Queueshows the queue draining:MessageCountfalling,Velocityabove 0 and no new LastError.- Message tracking shows
SENDorDELIVERevents for the stuck messages (message tracking guide).
PowerShell
Retry-Queue -Identity "EX01\fabrikam.com" -Resubmit $true
Get-Queue -Identity "EX01\fabrikam.com" | Format-List Status, MessageCount, Velocity, LastError
Get-MessageTrackingLog -Server EX01 -EventId SEND -Start (Get-Date).AddHours(-1) |
Format-Table Timestamp, Recipients, RecipientStatus -AutoSizeGood: the queue is empty or Ready, and RecipientStatus shows the next hop's 250 acceptance.
References#
- Queues and messages in queues in Exchange Server (Microsoft Learn): queue types, delivery types, statuses and Velocity
- 454 4.7.0 Temporary authentication failure and Outbound email messages are not sent (Microsoft Learn)
- Windows Sockets Error Codes (Microsoft Learn)
