Outbound email failing every 24-48 hours

""Outlook is unable to connect to your outgoing SMTP email server. If you continue to receive this message contact your server administrator or ISP."

What client gives that error? The Outlook client, or Outlook.com? Also, is there any more data you can dig up about the error? Maybe the Outlook log file?

'"She uses POP and that's been fine but that's via outlook.com."

Does she only use pop for the website and all her clients? Or do any use IMAP? If a client syncs via IMAP it will stop other devices from accessing it via POP. Also, I think if you are using port 25 for SMTP, the client needs to do a POP query to confirm IP before SMTP will allow access. If anyone can confirm this, that would be great.

 "I'm unable to telnet to the Cox SMTP server on port 25 or 446."

I am not sure what port 446 is. SMTP will use port 25 with no authentication, and no encryption, and only on Cox's network. Port 465 uses outbound authentication(user/password) and SSL encryption. Port 586 also uses outbound authentication but tries to force TLS encryption. When testing via Telnet, I use port 25. Do you get a error? Can you still ping the server smtp.cox.net?

"The one thing I've found that fixes it is to force an IP address change.MAC address is changed on PC, then Cox modem is reset. "

I assume this is when PC is connected direct to modem? What modem do you have BTW? Almost sounds like a IP block. Can you try setting up a client on your network, or some other network, with her settings, and see if that works?

"but Cox support didn't see any activity like that.  "

I think you may be on to something. But even Tier 2 would probably not have the access to check the servers direct. They probably said they didn't see anything like that because they can't see ANYTHING. 

"Could this potentially be the Cox modem?"

Unless the modem is actually a gateway, I would say no. It is a simple bridge, so it doesn't touch the traffic at all.

Tecknowhelp said:

""Outlook is unable to connect to your outgoing SMTP email server. If you continue to receive this message contact your server administrator or ISP."

What client gives that error? The Outlook client, or Outlook.com? Also, is there any more data you can dig up about the error? Maybe the Outlook log file?

That's Outlook on her PC when trying to retrieve email via SMTP.   I just now enabled the log in Outlook and will post back here with information if/when this happens again.

Tecknowhelp said:

'"She uses POP and that's been fine but that's via outlook.com."

Does she only use pop for the website and all her clients? Or do any use IMAP? If a client syncs via IMAP it will stop other devices from accessing it via POP. Also, I think if you are using port 25 for SMTP, the client needs to do a POP query to confirm IP before SMTP will allow access. If anyone can confirm this, that would be great.

POP only, no IMAP.  It hasn't been an issue using the outlook.com POP (instead of Cox POP) for the last couple years but I could change if needed.  I think there's an option where Cox can POP from other email providers if needed.

Tecknowhelp said:

 "I'm unable to telnet to the Cox SMTP server on port 25 or 446."

I am not sure what port 446 is. SMTP will use port 25 with no authentication, and no encryption, and only on Cox's network. Port 465 uses outbound authentication(user/password) and SSL encryption. Port 586 also uses outbound authentication but tries to force TLS encryption. When testing via Telnet, I use port 25. Do you get a error? Can you still ping the server smtp.cox.net?

I meant 465, sorry about that.  I've always used 25 but after calling tech support they suggested 465.  As for the telnet and ping question, no, neither one of those resolve to smtp.cox.net.

Tecknowhelp said:

"The one thing I've found that fixes it is to force an IP address change.MAC address is changed on PC, then Cox modem is reset. "

I assume this is when PC is connected direct to modem? What modem do you have BTW? Almost sounds like a IP block. Can you try setting up a client on your network, or some other network, with her settings, and see if that works?

Correct, PC direct connected to Cox modem.  Modem is a "Cisco DPQ3212 DOCSIS 3.0 2-PORT Voice Modem".  I've plugged in her SMTP information at my work (we have Cox business) when this error was happening and it worked fine so seemed local to her PC/connection.  Her SMTP login/authentication was fine.

Tecknowhelp said:

"Could this potentially be the Cox modem?"

Unless the modem is actually a gateway, I would say no. It is a simple bridge, so it doesn't touch the traffic at all.

I'm not sure exactly what you mean by a gateway in this context.  There's no router in between her PC and the modem so I would think that does make it a gateway.

Thanks for your reply!

DerrickW said:
@benf

What is the exact error message that you are getting from Outlook when she is having trouble sending?  I would also like to check the IP address against spam filtering lists when that happens to rule that out as a possible cause for the sending issue.

Below is the exact error.  I wrote down her IP addresses that got hung up when this happened but don't have that with me at the moment.  I can post that when I get home later this afternoon if needed.

benf said:
been an issue using the outlook.com POP (instead of Cox POP) for the last couple years but I could change if needed.

Could you explain what you mean by Outlook POP? Do you have a custom domain with Microsoft? Do you have Outlook.com setup to use pop.cox.net to download her email? 

benf said:
I meant 465, sorry about that.

Are you using outbound authentication? 

benf said:
As for the telnet and ping question, no, neither one of those resolve to smtp.cox.net.

So when the problem happens, you can't resolve smtp.cox.net? Do you mean resolve (DNS) or just that the ping and trace times out? If it doesn't resolve, can you ping your DNS server? If you just can't ping it, can you do a tracert? 

benf said:
t my work (we have Cox business) when this error was happening and it worked fine so seemed local to her PC/connection.

Is your work in the same town? Also, when it happens, try checking if her IP is black listed. MxToolbox is a great site for checking most things email. Also, if it is a custom domain, DNSStuff is good too.

benf said:
I'm not sure exactly what you mean by a gateway in this context.

A gateway is a modem/router combo. You have the DPQ3212 which is not a gateway, but a phone modem, AKA eMTA. Some people call gateways modems,  and if it was a gateway, and had NAT and firewall, then it may have been playing a role. Since you have a eMTA, it is not relevant. Sorry for confusion. 

Also, what is she using for Anti-virus? Norton has been known to cause the problem time to time. Try disabling it (msconfig?) and trying? The problem is how often does the problem happen? Is it easily replicatorable? Also, the changing of the IP may have nothing to do with the actual IP, but the refresh of the IP stack as the connection disco/reco with the modem reset. I just find it hard to believe her IP gets blacklisted again even after changing. Would think you would see signs of that serious of malware. However, if the Antivirus has items in the IP stack (Network connection properties) then resetting may be fixing it. Try disabling anything in the stack that is not the OS default.  If windows 7, should look like this. 

Thank you both for the information and efforts.   She has MS Security Essentials installed which I gather doesn't scan email at the point of sending.  I've seen Symantec products cause issues because it does scan email specifically, but I wouldn't expect that to cause it to completely lock up outbound on any future email send attempts.  When this has happened I've deleted the offending email(s) in the outbox, but just sending a simple test after that resulted in the same failure.

re: the other reply above, it seems like this happens about every 24-48 hours.  (This weekend was the 3rd time it's happened since Monday last week.)    I'm not able to replicate the actual "lock", I only know about it when she calls and tells me her email stopped working.  I did attempt a reset of the IP stack and winsock and it didn't help, though I didn't try a modem reset in between.   I confirmed my network connection settings match that of your attachment, though I've disabled IPV6.

Would it help if I sent her current IP address via PM so it can be monitored for unusual traffic?

benf said:
which I gather doesn't scan email at the point of sending.

I googled and found some conflicting info. Most says it doesn't scan email. However, windows firewall may still be blocking the port. Try disabling that?

benf said:
Would it help if I sent her current IP address via PM so it can be monitored for unusual traffic?

Cox can't look at traffic coming off your modem. They "might" be able to look at the connections made to the SMTP server by your IP, but it would be diffacult determining what is legitimate requests, and what is malware on the system. I say might because I think you would have to get pretty high up on the support ladder that would have access like that. Could you try blocking outbound port 25 on the PC or even router? That would assure only 465/587 are being used, which require password authentication. So unless the malware has her user/password, it wouldn't be able to send anymore.

Another thing you could try is setting up a smart phone or table (something portible) with her email settings and try from her network. If that works when her PC doesn't, then since they are both using the same public IP, would isolate it to a PC issue, not a IP issue. This would have to be done with the router in place ofcourse. 

Last, if the issue is just congestion of the SMTP server, you can try to increase the timeout period to avoid the error. I don't think this would help since you said changing the IP helps, but it is worth a try. See here for more info.

Yes, I did try disabling Windows firewall, at least at the point the issue occurred, but no change.  I haven't tried disabling the firewall while things are still working and am hesitant to do so for security reasons.  I did look into the firewall details while the email block was occurring and didn't see any active blocks on outgoing ports.

Good idea on trying wireless access via smartphone to eliminate her PC from the issue, I'll give that a try next time it happens, though as you said I'll have to re-introduce her router into the mix which I won't be able to do until this weekend.  I can also block port 25 at that time.

The volume of email is extremely low for her, she maybe sends 10 a day if even that.  If they're able to monitor SMTP traffic and see any more than 15-20 attempts in a day, something is wrong.  The only thing I'm not entirely sure of if just checking for email triggers SMTP action (even if no email in her outbox).  That being the case the requests would be fairly high since the Outlook client POPs for new email every 5 minutes.

Her SMTP timeout was set to 2 minutes before which has always been enough, but I'll bump it to 3 just in case.  Either way even it did timeout I still wouldn't expect it to lock any future send attempts.

Appreciate all your help and attention. 

As of about an hour ago this has happened again.  There's 3 emails that got stuck in the outbox, the first of which was at 1:37p local time.  Nothing unusual looking about the emails.    I haven't yet reset the IP address if there's any additional testing you'd like me to try, otherwise I'm going to be resetting in about an hour or so.

I'll send her current IP address to the email address listed above in just a couple minutes.   Thanks

I have the log from her Outlook client sessions as well.   I'm not seeing a smoking gun in there but you can see where it's successfully sent email, and then when it stops and shows it's not resolving.   

About the only thing semi-odd I'm seeing is that she sent an email to about 10 different addresses using the blind copy feature, and no addresses in the "To" line.  I can see where that might raise a red flag but she's done that many times prior to when this issue first started happening.

If you'd like me to send the Outlook log please let me know.  Thanks

Yes, webmail send works fine when Outlook/SMTP is not.  I still haven't reset her connection, will hold off until this evening.  Thank you!