Event ID 4006: The connection was dropped by the remote host

Chicago Area Laptop for rent: $35 per day plus $10 for additional day

Event ID 4006: The connection was dropped by the remote host

Symptom: sent e-mails are queued in Exchange. Additionally, The following event may be logged in the Application log:
Event Type: Warning
Event Source: MSExchangeTransport
Event Category: Connection Manager
Event ID: 4006
Computer: Server_Name
Description: The connection was dropped by the remote host IP address, Server_Name.Domain_Name.Root_Domain; the semaphore timeout period has expired.

Case 1: If all emails are queued in the Exchange, make sure your firewall doesn’t block port 25.

Case 2: It could be Smart Host settings issue. Make sure you have correct Exchange server’s FQDN in a Smart Host. To do that, go to IIS Manager -> Default SMTP Virtual Server -> Properties -> Delivery -> Advanced -> Smart Host.

Case 3: It could be Anti virus software configuration issue. You may want to disable" Internet E-mail Auto-protect" in the Symantec Antivirus Client or disable the antivirus email scanning and to exclude the \Inetpub and %systemroot%\system32\inetsrv from any real time virus scanning.

Case 4: Make sure the remote server is running and there might be network problems preventing the smtp service to reach the server.

Case 5: The remote server does not respond with an SMTP banner.
Resolution: To verify this cause, you can telnet to the remote server. For example, to telnet to a server that is named server.domain.com, follow these steps:
1. Open a command prompt.
2. At the command prompt, type telnet server.domain.com 25, and then press ENTER.
You must receive a response that resembles the following:
220 hostname.domain.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.1600 ready at Thu, 30 Nov 2000 18:09:43 -0600
If you do not receive a similar response, edit the metabase to configure an SMTP banner.

Case 6: Other e-mail systems do not recognize the Summary Transport Neutral Encapsulation Format (STNEF) formatting that is used in Exchange Server 2003.
Resolution: E-mail systems such as Microsoft Exchange Server 5.5 do not recognize STNEF formatting. If you have to work with such e-mail systems, you must force the store driver in Exchange Server 2003 to use Transport Neutral Encapsulation Format (TNEF). To do this, you must configure several registry entries on the Exchange Server 2003 server.

Case 7: Heuristics scanning is enabled in the Symantec Mail Security for Microsoft Exchange program. Heuristics scanning alters a message. This causes the terminating period to appear at the end of the message text. Therefore, the message is prevented from being terminated.
Resolution: You must disable heuristics scanning in the Symantec Mail Security for Microsoft Exchange program.

Case 8: The Norton Symantec AntiVirus Corporate Edition 9.x client is installed in the organization. The problem that is described in the "Symptoms" section is caused by the Internet E-mail Auto-Protect scanner feature that is included in the Norton Symantec AntiVirus Corporate Edition 9.x client.
Resolution: The Norton Symantec AntiVirus Corporate Edition 9.x Internet E-mail Auto-Protect scanner feature should not be enabled. To remove this feature, follow the steps that are described in Symantec document ID 2004061009504348.

Case 9: The IP INSPECT NAME Inspection_Name SMTP statement is enabled in the firewall feature set on a Cisco firewall.
Resolution: Disable the IP INSPECT NAME Inspection_Name SMTP statement on the Cisco firewall. For more information about how to do this, refer to the product's manual.

Case 10: The metabase is corrupted.

Resolution: If the other causes do not apply, the metabase may be corrupted. To replace a corrupted metabase, follow the steps in the "The IIS metabase is corrupted" section of the following article in the Microsoft Knowledge Base:
304166 Exchange databases are not mounted and event logs contain error messages

Post your questions, comments, feedbacks and suggestions

Contact a consultant