Alerting

Splunk Alerting by Email Error - 501 5.5.4 Invalid Domain Name

FRoth
Contributor

We configured some alerts that should send an email when fired, but no email gets through. We noticed errors in the internal log that said:

05-26-2014 17:32:56.527 +0200 ERROR ScriptRunner - stderr from 'E:\splunk\etc\apps\search\bin\sendemail.py': ERROR:root:(501, '5.5.4 Invalid domain name') while sending mail to: a.miller@company.com

The SMTP server itself logs:

2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,3,10.40.13.54:25,10.41.3.200:26174,<,ehlo SV0842.company.com.,
2014-05-26T05:38:08.117Z,SV0490\Relay SV0490,08D1455F6B42D2E9,4,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,5,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,6,10.40.13.54:25,10.41.3.200:26174,<,helo SV0842.company.com.,
2014-05-26T05:38:13.125Z,SV0490\Relay SV0490,08D1455F6B42D2E9,7,10.40.13.54:25,10.41.3.200:26174,*,Tarpit for '0.00:00:05',
2014-05-26T05:38:18.133Z,SV0490\Relay SV0490,08D1455F6B42D2E9,8,10.40.13.54:25,10.41.3.200:26174,>,501 5.5.4 Invalid domain name,

The mail admins said that our source IP should be free to send with any source address - we configured splunk@server, splunk@server.fqdn.com without any success. We also changed the server name in the General Settings to the FQDN but nothing helped.
We believe that it has to do with the name sent after HELO/EHLO but we cant see what it is.
We have no idea what the reason for this behaviour could be.

Any ideas?

linu1988
Champion

if you have some org specific email id which deviates from our general email format you may take a look at the below answer. Splunk has mentioned a specific email id format.

http://answers.splunk.com/answers/124873/alert-email-address-doesnt-allow-our-domain

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...