Event ID 4006: The connection
was dropped by the remote host
Symptom: sent e-mails are queued in Exchange. Additionally, The following
event may be logged in the Application log:
Event Type: Warning
Event Source: MSExchangeTransport
Event Category: Connection Manager
Event ID: 4006
Computer: Server_Name
Description: The connection was dropped by the remote host IP address,
Server_Name.Domain_Name.Root_Domain; the semaphore timeout period has
expired.
Case 1: If all emails are queued in the Exchange, make sure your firewall
doesn’t block port 25.
Case 2: It could be Smart Host settings issue. Make sure you have correct
Exchange server’s FQDN in a Smart Host. To do that, go to IIS Manager ->
Default SMTP Virtual Server -> Properties -> Delivery -> Advanced -> Smart
Host.
Case 3: It could be Anti virus software configuration issue. You may want to
disable" Internet E-mail Auto-protect" in the Symantec Antivirus Client or
disable the antivirus email scanning and to exclude the \Inetpub and %systemroot%\system32\inetsrv
from any real time virus scanning.
Case 4: Make sure the remote server is running and there might be network
problems preventing the smtp service to reach the server.
Case 5: The remote server does not respond with an SMTP banner.
Resolution: To verify this cause, you can telnet to the remote server. For
example, to telnet to a server that is named server.domain.com, follow these
steps:
1. Open a command prompt.
2. At the command prompt, type telnet server.domain.com 25, and then press
ENTER.
You must receive a response that resembles the following:
220 hostname.domain.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.1600
ready at Thu, 30 Nov 2000 18:09:43 -0600
If you do not receive a similar response, edit the metabase to configure an
SMTP banner.
Case 6: Other e-mail systems do not recognize the Summary Transport Neutral
Encapsulation Format (STNEF) formatting that is used in Exchange Server
2003.
Resolution: E-mail systems such as Microsoft Exchange Server 5.5 do not
recognize STNEF formatting. If you have to work with such e-mail systems,
you must force the store driver in Exchange Server 2003 to use Transport
Neutral Encapsulation Format (TNEF). To do this, you must configure several
registry entries on the Exchange Server 2003 server.
Case 7: Heuristics scanning is enabled in the Symantec Mail Security for
Microsoft Exchange program. Heuristics scanning alters a message. This
causes the terminating period to appear at the end of the message text.
Therefore, the message is prevented from being terminated.
Resolution: You must disable heuristics scanning in the Symantec Mail
Security for Microsoft Exchange program.
Case 8: The Norton Symantec AntiVirus Corporate Edition 9.x client is
installed in the organization. The problem that is described in the
"Symptoms" section is caused by the Internet E-mail Auto-Protect scanner
feature that is included in the Norton Symantec AntiVirus Corporate Edition
9.x client.
Resolution: The Norton Symantec AntiVirus Corporate Edition 9.x Internet
E-mail Auto-Protect scanner feature should not be enabled. To remove this
feature, follow the steps that are described in Symantec document ID
2004061009504348.
Case 9: The IP INSPECT NAME Inspection_Name SMTP statement is enabled in the
firewall feature set on a Cisco firewall.
Resolution: Disable the IP INSPECT NAME Inspection_Name SMTP statement on
the Cisco firewall. For more information about how to do this, refer to the
product's manual.
Case 10: The metabase is corrupted.
Resolution: If the other causes do not apply, the metabase may be corrupted.
To replace a corrupted metabase, follow the steps in the "The IIS metabase
is corrupted" section of the following article in the Microsoft Knowledge
Base:
304166 Exchange databases are not mounted and event logs contain error
messages
