Cisco Cisco Email Security Appliance X1070 Troubleshooting Guide

Contributed by Karl Young and Robert Sherwin, Cisco TAC Engineers.

Oct 14, 2014

This document describes messages rejected and bounced due to large headers on the Cisco Email Security
Appliance (ESA).

When a host tries to send mail with a large header, the ESA may reject it. The end−user may see one of the
following error messages:

"552 #5.3.4 message header size exceeds limit"

"500 #5.5.1 command not recognized"

"421 Exceeded bad SMTP command limit"

In other cases, the host may keep retrying the same message.

There is a 1000−line limit for the message header. When the header length exceeds 1000 lines, the ESA sends
the message "552 #5.3.4 message header size exceeds limit" to the sending host.  

Some hosts may ignore this message and continue to send data. The ESA interprets this data as SMTP
commands, and returns, "500 #5.5.1 command not recognized" for each line.

After surpassing the limit of 4 bad SMTP commands, the ESA then returns the message, "421 Exceeded bad
SMTP command limit", and drops the connection.

This setting can be changed on the CLI only:

myesa.local> listenerconfig

Currently configured listeners:

1. listener_myesa.local (on Management, 192.168.0.199) SMTP TCP Port 25 Public

Choose the operation you want to perform:

− NEW − Create a new listener.

− EDIT − Modify a listener.