> Source: [sk1000199](https://support.checkpoint.com/results/sk/sk1000199)

# sk1000199 - SMTP connections intermittently fail through Security Gateway with Anti-Spam enabled

| Property | Value |
|----------|-------|
| Solution ID | sk1000199 |
| Date Created | 2026-09-28 |
| Last Modified | 2026-10-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Simple Mail Transfer Protocol (SMTP) connections intermittently fail through the Security Gateway when the Anti-Spam blade is enabled.
* The Security Gateway intermittently sends Transmission Control Protocol (TCP) reset (RST) or reset-acknowledgment (RST-ACK) packets to external SMTP clients.
* Disabling the Anti-Spam blade stops the SMTP failures.
* There are more than 40 firewall worker instances. You can check with the command in expert mode - "fw ctl multik stat"

## Cause

When Anti-Spam inspection is enabled for SMTP traffic, the Security Gateway processes SMTP connections using SMTP Security Server user-space worker processes managed by the `emaild.smtp` daemon. After the gateway folds the SMTP traffic locally, these workers inspect and relay the SMTP sessions before forwarding them to their destination.  

Each CoreXL processing path requires an available SMTP Security Server worker and a corresponding fold target. This enables SMTP traffic to be redirected locally for inspection before being relayed to the destination mail server.

The number of available SMTP Security Server service sockets is limited to 40 by the `MaxServiceSockets` parameter. When the number of firewall worker instances exceeds 40, there are insufficient SMTP Security Server sockets to accommodate every firewall worker. As a result, some workers cannot be associated with an SMTP Security Server, preventing SMTP traffic handled by those workers from being folded and inspected correctly.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content