Monitoring Connections Attempts

Document created by user.oxriBaJeN4 Employee on Sep 11, 2015Last modified by user.oxriBaJeN4 Employee on Mar 27, 2017
Version 4Show Document
  • View in full screen mode

Connection Attempts displays all connections made to your Mimecast account, which were not initially successful, and therefore not accepted. These emails may subsequently have been accepted, depending on the reason for the initial temporary failure.  A common reason for an email connection to be logged in Connection Attempts, would be for a mail server that has been subjected to greylisting.  Once the mail server retries the connection (as long as it is between 1 minute and 12 hours after the initial connection), the email will be accepted.


Reviewing Connections can be helpful when troubleshooting delayed inbound delivery attempts.  The Connection description will detail why Mimecast temporarily failed the connection, and this could be due to a variety of reasons (as listed below).  The mail server will be required to retry the connection, in an attempt to successfully deliver the email.  The initial reason for the temporary failure will determine if the email is subsequently accepted.


Using Connection Attempts


It is not necessary for Administrators to monitor Connection Attempts, and should typically only be required when troubleshooting a delayed inbound email.


To view Connection Attempts:

  1. Log in to the Administration Console.
  2. Click on the Administration toolbar button. A menu drop down is displayed.
  3. Click on the Monitoring | Connections menu item.


Connection Attempts lists all connections for today by default, although this information is retained for a maximum of 7 days.  Use the calendar controls at the top of the screen to view Connection Attempts for previous days.  (For details regarding connection attempts older than 7 days, please contact Mimecast support.)


The information provided includes the sender address, recipient’s address and IP address of the sending mail server (known as the Triplet), as well as the description of the failed attempt, and the date and time:




To search for a specific failed connection attempt, enter the email address, domain or IP address in the search bar, and click the Search button.


Once the results are displayed, select the specific item to view the details:


Some common Connection Attempt examples, and additional information are listed below:


Connection AttemptAdditional Information
Attempt GreylistingIndicates that the sending IP server has been subjected to greylisting.  The triplet of information is temporarily failed until the mail server retries the connection (this retry must be between 1 minute and 12 hours after the initial connection)
Sender Dropped ConnectionThe remote mail server deliberately dropped the connection
Remote Server Timed outThe remote mail server timed out during the SMTP conversation, usually while attempting to transfer the email content.  A common cause for this, is a Firewall or other SMTP scanning product located within the senders infrastructure, that prevents the content of the email from being sent.  This attempt is logged after 10 minutes of inactivity from the remote server
Connection Timed OutThe initial connection is made to Mimecast, but the remote server does not continue with the SMTP conversation.  Mimecast timed out the connection waiting for the remote server to send data
Message Ended EarlyThis can be caused by files that have previously been infected with a virus, and have not been cleaned correctly by an anti-virus product, which has left traces in the email.  This can also be caused by Firewall issues on the sender’s side, or incorrectly configured content rules on a security device
Local CT IP Reputation Policy (Temporary)

The sending IP address has a poor enough reputation for Mimecast to temporarily defer the email (with a 400 series code), but not poor enough to reject the email (with a 500 series code).  The database used is dynamic and updates constantly. If the reputation of the IP address remains the same, the email will be accepted in future attempts.  If the reputation gets worse, the email will be rejected.

You can request a review of your source IP ranges by completing our online form, available at:

4 people found this helpful