We configured some alerts that should send an email when fired, but no email gets through. We noticed errors in the internal log that said:
05-26-2014 17:32:56.527 +0200 ERROR ScriptRunner - stderr from 'E:\splunk\etc\apps\search\bin\sendemail.py': ERROR:root:(501, '5.5.4 Invalid domain name') while sending mail to: a.miller@company.com
The SMTP server itself logs:
2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,3,10.40.13.54:25,10.41.3.200:26174,<,ehlo SV0842.company.com.,
2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,4,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,5,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,6,10.40.13.54:25,10.41.3.200:26174,<,helo SV0842.company.com.,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,7,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:18.133Z,SV0490\Relay SV0490,08D1455F6B42D2E9,8,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name,
The mail admins said that our source IP should be free to send with any source address - we configured splunk@server, splunk@server.fqdn.com without any success. We also changed the server name in the General Settings to the FQDN but nothing helped.
We believe that it has to do with the name sent after HELO/EHLO but we cant see what it is.
We have no idea what the reason for this behaviour could be.
Any ideas?
