Hi All,
We've seem to start having issues with random "Socket 10060 - The Connection has timed out" errors.
Our SMTP timeouts were set to 5 minutes changed now to 10 minutes. But seems to be still occuring on some mails.
We have an Hybrid Enviroment where we use the MDaemon server to host non-365 accounts and users and then forward some to 365 and use internal routing between exchange and mdaemon to send mails.
Has anyone perhaps found the cause and possible fix as we didn't change the firewall, AV settings or any other settings nor was there a dip in the network while this was occuring.
Please find below attached logs in the chat reponse if needed.
Wed 2026-07-01 21:11:41.377: Session 73290968; child 0001
Wed 2026-07-01 21:11:41.377: Accepting SMTP connection from 41.74.205.153:43445 to serverip
Wed 2026-07-01 21:11:41.377: Location Screen says connection is from South Africa, Africa
Wed 2026-07-01 21:11:41.380: --> 220 ESMTP Wed, 01 Jul 2026 21:11:41 +0200
Wed 2026-07-01 21:11:41.399: <-- EHLO za-smtp-delivery-153.mimecast.co.za
Wed 2026-07-01 21:11:41.399: --> 250- Hello za-smtp-delivery-153.mimecast.co.za [41.74.205.153], pleased to meet you
Wed 2026-07-01 21:11:41.399: --> 250-ETRN
Wed 2026-07-01 21:11:41.399: --> 250-AUTH LOGIN CRAM-MD5 PLAIN
Wed 2026-07-01 21:11:41.399: --> 250-8BITMIME
Wed 2026-07-01 21:11:41.399: --> 250-ENHANCEDSTATUSCODES
Wed 2026-07-01 21:11:41.399: --> 250-PIPELINING
Wed 2026-07-01 21:11:41.399: --> 250-CHUNKING
Wed 2026-07-01 21:11:41.399: --> 250-STARTTLS
Wed 2026-07-01 21:11:41.399: --> 250 SIZE
Wed 2026-07-01 21:11:41.418: <-- STARTTLS
Wed 2026-07-01 21:11:41.418: --> 220 2.7.0 Ready to start TLS
Wed 2026-07-01 21:11:41.465: SSL negotiation successful (TLS 1.2, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
Wed 2026-07-01 21:11:41.484: <-- EHLO za-smtp-delivery-153.mimecast.co.za
Wed 2026-07-01 21:11:41.484: --> 250-mail.trueit.co.za Hello za-smtp-delivery-153.mimecast.co.za [41.74.205.153], pleased to meet you
Wed 2026-07-01 21:11:41.484: --> 250-ETRN
Wed 2026-07-01 21:11:41.484: --> 250-AUTH LOGIN CRAM-MD5 PLAIN
Wed 2026-07-01 21:11:41.484: --> 250-8BITMIME
Wed 2026-07-01 21:11:41.484: --> 250-ENHANCEDSTATUSCODES
Wed 2026-07-01 21:11:41.484: --> 250-PIPELINING
Wed 2026-07-01 21:11:41.484: --> 250-CHUNKING
Wed 2026-07-01 21:11:41.484: --> 250-REQUIRETLS
Wed 2026-07-01 21:11:41.484: --> 250 SIZE
Wed 2026-07-01 21:11:41.504: <-- MAIL FROM:<external>
Wed 2026-07-01 21:11:41.504: Performing PTR lookup (153.205.74.41.IN-ADDR.ARPA)
Wed 2026-07-01 21:11:41.505: * D=153.205.74.41.IN-ADDR.ARPA TTL=(1381) PTR=[za-smtp-delivery-153.mimecast.co.za]
Wed 2026-07-01 21:11:51.506: * DNS: 10 second wait for DNS response exceeded (DNS Server: 10.0.0.1)
Wed 2026-07-01 21:11:51.753: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.201.153]
Wed 2026-07-01 21:11:51.753: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.194.153]
Wed 2026-07-01 21:11:51.753: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.205.153]
Wed 2026-07-01 21:11:51.753: ---- End PTR results
Wed 2026-07-01 21:11:51.753: Performing IP lookup (za-smtp-delivery-153.mimecast.co.za)
Wed 2026-07-01 21:11:51.754: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.201.153]
Wed 2026-07-01 21:11:51.754: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.194.153]
Wed 2026-07-01 21:11:51.754: * D=za-smtp-delivery-153.mimecast.co.za TTL=(5) A=[41.74.205.153]
Wed 2026-07-01 21:11:51.754: ---- End IP lookup results
Wed 2026-07-01 21:11:51.755: Performing IP lookup (external)
Wed 2026-07-01 21:11:51.782: * P=010 S=000 D=firstnet.co.za TTL=(1) MX=[za-smtp-inbound-2.mimecast.co.za] {41.74.197.210}
Wed 2026-07-01 21:11:51.782: * P=010 S=001 D=firstnet.co.za TTL=(1) MX=[za-smtp-inbound-1.mimecast.co.za] {41.74.193.210}
Wed 2026-07-01 21:11:51.782: ---- End IP lookup results
Wed 2026-07-01 21:11:51.782: Performing SPF lookup (za-smtp-delivery-153.mimecast.co.za / 41.74.205.153)
Wed 2026-07-01 21:11:51.782: * Policy (cache): v=spf1 a include:za._netblocks.mimecast.com -all
Wed 2026-07-01 21:11:51.783: * Evaluating a: match
Wed 2026-07-01 21:11:51.783: * Result: pass
Wed 2026-07-01 21:11:51.783: ---- End SPF results
Wed 2026-07-01 21:11:51.783: Performing SPF lookup ()
Wed 2026-07-01 21:11:51.783: * Policy (cache): v=spf1 include:za._netblocks.mimecast.com include:servers.mcsv.net include:a:opus.isdsl.net include:_netblocks.ionline.co.za a:email.varibill.com include:u48392.wl143.sendgrid.net include:zoho.com a ip4:168.245
Wed 2026-07-01 21:11:51.783: * Evaluating include:za._netblocks.mimecast.com: performing lookup
Wed 2026-07-01 21:11:51.784: * Policy (cache): v=spf1 ip4:41.74.192.0/22 ip4:41.74.200.0/23 ip4:41.74.196.0/22 ip4:41.74.204.0/23 ip4:41.74.206.0/24 ~all
Wed 2026-07-01 21:11:51.784: * Evaluating ip4:41.74.192.0/22: no match
Wed 2026-07-01 21:11:51.784: * Evaluating ip4:41.74.200.0/23: no match
Wed 2026-07-01 21:11:51.784: * Evaluating ip4:41.74.196.0/22: no match
Wed 2026-07-01 21:11:51.784: * Evaluating ip4:41.74.204.0/23: match
Wed 2026-07-01 21:11:51.784: * Evaluating include:za._netblocks.mimecast.com: match
Wed 2026-07-01 21:11:51.784: * Result: pass
Wed 2026-07-01 21:11:51.784: ---- End SPF results
Wed 2026-07-01 21:11:51.784: --> 250 2.1.0 Sender OK
Wed 2026-07-01 21:12:13.317: * Socket error 10060 - The connection timed out.
Wed 2026-07-01 21:12:13.317: SMTP session terminated (Bytes in/out: 793/3737)
Wed 2026-07-01 21:12:13.317: ----------
Without seeing the sending servers logs, I don't know this for sure, but it looks to me like the sending server is just giving up on the session because MDaemon didn't response quickly enough. MDaemon didn't respond quickly enough because a DNS lookup to your DNS server timed out.
Wed 2026-07-01 21:11:41.504: Performing PTR lookup (153.205.74.41.IN-ADDR.ARPA)
Wed 2026-07-01 21:11:41.505: * D=153.205.74.41.IN-ADDR.ARPA TTL=(1381) PTR=[za-smtp-delivery-153.mimecast.co.za]
Wed 2026-07-01 21:11:51.506: * DNS: 10 second wait for DNS response exceeded (DNS Server: 10.0.0.1)
Clearly the DNS server is working, since the other lookups were successful, but I think MDaemon waiting for that 1 lookup to complete was long enough for mimecast to drop the session.
You could lower the timeout for the DNS lookups to try to avoid the issue, but the fact that the DNS server is taking that long to respond for some requests indicates something is wrong with the DNS server.
@Arron
I can send you some other logs from our 365 Exchange to On-Prem Mdaemon where 365 user in our domain is sending to On-Prem Mdaemon in the same domain where it gives the same error
Wed 2026-07-08 15:49:58.964: ----------
Wed 2026-07-08 15:49:30.963: Session 73453784; child 0001
Wed 2026-07-08 15:49:30.963: Accepting SMTP connection from 40.93.214.97:28427 to 10.0.0.41:25
Wed 2026-07-08 15:49:30.963: Location Screen says connection is from Sweden, Europe
Wed 2026-07-08 15:49:30.966: --> 220 mail.trueit.co.za ESMTP Wed, 08 Jul 2026 15:49:30 +0200
Wed 2026-07-08 15:49:31.138: <-- EHLO GV1PR07CU001.outbound.protection.outlook.com
Wed 2026-07-08 15:49:31.138: --> 250-mail.trueit.co.za Hello GV1PR07CU001.outbound.protection.outlook.com [40.93.214.97], pleased to meet you
Wed 2026-07-08 15:49:31.138: --> 250-ETRN
Wed 2026-07-08 15:49:31.138: Location Screening hiding AUTH from country Sweden, Europe
Wed 2026-07-08 15:49:31.138: --> 250-8BITMIME
Wed 2026-07-08 15:49:31.138: --> 250-ENHANCEDSTATUSCODES
Wed 2026-07-08 15:49:31.138: --> 250-PIPELINING
Wed 2026-07-08 15:49:31.138: --> 250-CHUNKING
Wed 2026-07-08 15:49:31.138: --> 250-STARTTLS
Wed 2026-07-08 15:49:31.138: --> 250 SIZE
Wed 2026-07-08 15:49:31.310: <-- STARTTLS
Wed 2026-07-08 15:49:31.310: --> 220 2.7.0 Ready to start TLS
Wed 2026-07-08 15:49:31.672: SSL negotiation successful (TLS 1.2, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
Wed 2026-07-08 15:49:31.845: <-- EHLO GV1PR07CU001.outbound.protection.outlook.com
Wed 2026-07-08 15:49:31.845: --> 250-mail.trueit.co.za Hello GV1PR07CU001.outbound.protection.outlook.com [40.93.214.97], pleased to meet you
Wed 2026-07-08 15:49:31.845: --> 250-ETRN
Wed 2026-07-08 15:49:31.845: Location Screening hiding AUTH from country Sweden, Europe
Wed 2026-07-08 15:49:31.845: --> 250-8BITMIME
Wed 2026-07-08 15:49:31.845: --> 250-ENHANCEDSTATUSCODES
Wed 2026-07-08 15:49:31.845: --> 250-PIPELINING
Wed 2026-07-08 15:49:31.845: --> 250-CHUNKING
Wed 2026-07-08 15:49:31.845: --> 250-REQUIRETLS
Wed 2026-07-08 15:49:31.845: --> 250 SIZE
Wed 2026-07-08 15:49:32.042: <-- MAIL FROM:<Internal User> SIZE=614238
Wed 2026-07-08 15:49:32.042: Performing PTR lookup (97.214.93.40.IN-ADDR.ARPA)
Wed 2026-07-08 15:49:32.095: * D=97.214.93.40.IN-ADDR.ARPA TTL=(0) PTR=[mail-gv1pr07cu00101.outbound.protection.outlook.com]
Wed 2026-07-08 15:49:32.096: * D=mail-gv1pr07cu00101.outbound.protection.outlook.com TTL=(3) A=[40.93.214.97]
Wed 2026-07-08 15:49:32.096: ---- End PTR results
Wed 2026-07-08 15:49:32.096: Performing IP lookup (GV1PR07CU001.outbound.protection.outlook.com)
Wed 2026-07-08 15:49:32.097: * D=GV1PR07CU001.outbound.protection.outlook.com TTL=(2) A=[40.93.214.100]
Wed 2026-07-08 15:49:32.097: ---- End IP lookup results
Wed 2026-07-08 15:49:32.097: Performing IP lookup
Wed 2026-07-08 15:49:32.104: ---- End IP lookup results
Wed 2026-07-08 15:49:32.109: Performing SPF lookup (GV1PR07CU001.outbound.protection.outlook.com / 40.93.214.97)
Wed 2026-07-08 15:49:32.163: * Result: none; no SPF record in DNS
Wed 2026-07-08 15:49:32.163: ---- End SPF results
Wed 2026-07-08 15:49:32.164: --> 250 2.1.0 Sender OK
Wed 2026-07-08 15:49:32.164: <-- RCPT TO:<internal user>
Wed 2026-07-08 15:49:32.177: --> 250 2.1.5 Recipient OK
Wed 2026-07-08 15:49:32.177: <-- RCPT TO:<internal user>
Wed 2026-07-08 15:49:32.190: --> 250 2.1.5 Recipient OK
Wed 2026-07-08 15:49:32.600: <-- BDAT 597156 LAST
Wed 2026-07-08 15:49:33.295: Message size: 597156 bytes
Wed 2026-07-08 15:49:33.296: Performing DKIM verification
Wed 2026-07-08 15:49:33.296: * File: c:\mdaemon\queues\temp\md5001000001409.tmp
Wed 2026-07-08 15:49:33.296: * Message-ID: <VI0P190MB2357B511AFEF7D222722F05588FF2@VI0P190MB2357.EURP190.PROD.OUTLOOK.COM>;
Wed 2026-07-08 15:49:33.300: * Verification result: good signature
Wed 2026-07-08 15:49:33.300: * Result: pass
Wed 2026-07-08 15:49:33.300: ---- End DKIM results
Wed 2026-07-08 15:49:33.321: Passing message through AntiVirus (Size: 597156)...
Wed 2026-07-08 15:49:33.413: * Message is clean (no viruses found) scanned by (IKARUS: clean (0.00915s)) (ClamAV: clean (0.05894s))
Wed 2026-07-08 15:49:33.413: ---- End AntiVirus results
Wed 2026-07-08 15:49:35.516: Passing message through Outbreak Protection...
Wed 2026-07-08 15:49:35.516: * Message-ID: <VI0P190MB2357B511AFEF7D222722F05588FF2@VI0P190MB2357.EURP190.PROD.OUTLOOK.COM>
Wed 2026-07-08 15:49:35.516: * Reference-ID: str=0001.0A2D0315.6A4E556F.0023,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
Wed 2026-07-08 15:49:35.516: * Virus result: 0 - Clean
Wed 2026-07-08 15:49:35.516: * Spam result: 1 - Clean
Wed 2026-07-08 15:49:35.516: * IWF result: 0 - Clean
Wed 2026-07-08 15:49:35.516: ---- End Outbreak Protection results
Wed 2026-07-08 15:50:00.333: Socket error sending response to DATA
Wed 2026-07-08 15:50:00.334: * Socket error 10060 - The connection timed out.
Wed 2026-07-08 15:50:00.334: SMTP session terminated (Bytes in/out: 599121/3797)
Wed 2026-07-08 15:50:00.334: ----------
Both log snippets show that after about 30 seconds, the connection is dropped. This could be packets getting dropped along the route, or it could be the sending servers getting tired of waiting and just dropping the connections. Even if the DNS timeout is not the root cause of this issue, it should be fixed.
Are you running a local DNS server? or is 10.0.0.1 the IP of the gateway for your ISP?
Does yoru firewall show any errors or log any connections being blocked at the time? is the firewall configured to inspect SMTP or does it just pass it through?
When the issue occurs does it affect all active sessions in MDaemon? Is it isolated to a single session or a mulitple sessions (but not all sessions) impacted by the issue?
Are there any errors in the Windows event log when the issue occurs?
I would also suggest running a packet capture on the MDaemon server using WireShark until the error occurs. This will capture all network traffic going to and from the server. Once the issue occurs and is captured, please upload the capture to us along with the inbound SMTP log for the same time period at https://mdaemon.sharefile.com/r-rc3922c1eed334d4dbf5e34f0bd04ccd6 and let us know the name of the file you uploaded.
@Arron Running Local DNS server.
Firewall doesn't show any Error logs or connections being blocked at the time.
When the issue occurs it only is isolated to the single session (mail).
Think going to try revert back to previous version of Mdaemon as we are on 26.0.3.
@Arron
Do you have the version 26.0.2 download perhaps?
I don't think downgrading is going to change the behavior, this portion of MDaemon has not changed in a while. However, you are welcome to try it. Before you downgrade, if you have not already tried it, please reboot the server and see if the issue goes away, its a long shot, but I've seen stranger things from windows.
Unfortunately, you'll have to reach out to our support team directly to obtain the MDaemon 26.0.0 installer. You can find all of the support options here, https://mdaemon.com/pages/support-options. Please be sure to include your registration key when you contact the support team.
@Arron, already tried rebooting the server unfortunately didn't work.
Hi @Arron ,
Seems that I found the issue.
The SpamAssassin folder was big and could be corrupted causing the socket failures.
When I renamed the Bayers folder under SpamAssassin and rebooted the server.
Suddenly Socket errors went away. Mails working now normally. Big test is tomorrow during work hours where we must make sure everything is working.
Did you happen to keep a copy of the Bayes folder? If you did, can you upload to us for investigation?
https://mdaemon.sharefile.com/r-rc3922c1eed334d4dbf5e34f0bd04ccd6
Do you have Bayesian automatic token expiration enabled? It can be found in Remote Administration under Spam Filter | Filter Settings | Bayesian Auto-learning.
What do you have configured as the Maximum Bayesian database tokens?
English
Chinese (Simplified)
French
German
Italian
Japanese
Russian
Spanish
Vietnamese
