> Source: [sk108878](https://support.checkpoint.com/results/sk/sk108878)

# sk108878 - E-mails are delayed for several hours when Threat Emulation blade and Mail Transfer Agent (MTA) are enabled

| Property | Value |
|----------|-------|
| Solution ID | sk108878 |
| Date Created | 2015-12-21 |
| Last Modified | 2026-02-12 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81 (EOS) |

## Symptoms

- * E-mails are delayed for several hours.

* The following errors are seen in the MTA Queue:

  * `mail transport unavailable`
  * `lost connection with 127.0.0.1[127.0.0.1] while sending end of data -- message may be sent more than once`

  *Example*:

  ```
  
  ...   ... Wed May 22 17:56:36  admin@domain.com
  (mail transport unavailable) 
  
  ...   ... Wed May 22 17:56:36  alias@domain.com
  (lost connection with 127.0.0.1[127.0.0.1] while sending end of data -- message may be sent more than once) 
  ```

* */var/log/scrub/in.emaild.mta_messages* file shows errors like these:
  * `postfix/qmgr[`*PID*`]: XXX: to=<alias@domain.com>, relay=none, delay=..., delays=.../.../.../..., dsn=4.3.0, status=deferred (mail transport unavailable)`
  * `postfix/smtp[`*PID* `]: XXX: to=<alias@domain.com>, relay=127.0.0.1[127.0.0.1]:`*N*`, conn_use=..., delay=..., delays=.../.../.../..., dsn=4.4.2, status=deferred (lost connection with 127.0.0.1[127.0.0.1] while sending end of data -- message may be sent more than once)`
  * `postfix/smtp[`*PID* `]: XXX: to=<alias@domain.com>, relay=127.0.0.1[127.0.0.1]:`*N*`, delay=..., delays=.../.../.../..., dsn=4.0.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 Retry later. Email Session ID: {...} (in reply to end of DATA command))`
* SmartView Tracker log from Threat Emulation shows:

  `Description = Cloud emulation failed. Reason: Network Connectivity error. Verify that internet connection is up and that Proxy/DNS settings are correct.. This happened `*XX*` times in the last 60 minutes.`

## Cause

The Mail Transfer Agent (MTA) (postfix) is unable to connect to Threat Emulation Daemon (ted).

## Solution

Follow this action plan on Threat Emulation gateway:

**Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.

1. Run the command:

   ***\[Expert@HostName:0\]# /opt/postfix/usr/sbin/postqueue -c /opt/postfix/etc/postfix -f***
   to force the queue to be delivered. It may be necessary to run the command several times until the queue will be fully cleared.   

2. In case the issue did not resolve, collect the relevant debugs:

   1. Start the debug of Threat Emulation Daemon:

      ***\[Expert@HostName:0\]# tecli debug on***
      Note: Refer to [R77 versions Threat Prevention Administration Guide](https://sc1.checkpoint.com/documents/R77/CP_R77_ThreatPrevention_WebAdmin/html_frameset.htm) - Chapter "Configuring Advanced Threat Prevention Settings" - "Threat Prevention CLI Commands" - "tecli" - "[tecli debug](https://sc1.checkpoint.com/documents/R77/CP_R77_ThreatPrevention_WebAdmin/101703.htm#o104312)".   

   2. Start the debug of Mail Transfer Agent (MTA) daemon *in.emaild.mta* (based on [sk60387](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk60387)):

      ***\[Expert@HostName:0\]# fw debug in.emaild.mta on TDERROR_ALL_ALL=5***   

   3. Replicate the issue.   

   4. Stop the debug of Threat Emulation Daemon:

      ***\[Expert@HostName:0\]# tecli debug off***   

   5. Stop the debug of Mail Transfer Agent (MTA) daemon *in.emaild.mta*:

      ***\[Expert@HostName:0\]# fw debug in.emaild.mta off TDERROR_ALL_ALL=0***   

   6. Collect and send the following files to [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) for analysis:

      * *$FWDIR/log/ted.elg\**
      * *$FWDIR/log/emaild.mta.elg\**
      * */var/log/scrub/in.emaild.mta_messages\**
      * */var/log/messages\**
      * [CPinfo file](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Threat Emulation gateway
      * [CPinfo file](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server

**Related documentation and solutions:**

* [R77 versions Threat Prevention Administration Guide](https://sc1.checkpoint.com/documents/R77/CP_R77_ThreatPrevention_WebAdmin/html_frameset.htm)
* [sk108553 - Mail Transfer Agent (MTA) - FAQ](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108553)
* [sk109699 - ATRG: Mail Transfer Agent (MTA)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109699)
* [sk60387 - Troubleshooting and debugging Data Loss Prevention (DLP)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk60387)
* [sk97638 - Check Point Processes and Daemons](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97638)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content