Understanding relay delivery failures and retries
When Cleanbox cannot deliver a relay message to your mail server via SMTP, the message enters a retry queue. This article explains how the queue works, common failure reasons, and how to fix them.
How the retry queue works
When SMTP forwarding to your mail server fails, Cleanbox does not reject the email. Instead:
- The message is stored with status pending
- The sending server receives a
250 OKresponse (the email is accepted) - Cleanbox retries delivery with exponential backoff
Retry schedule
| Attempt | Delay | Total elapsed |
|---|---|---|
| 1 | Immediate | 0 |
| 2 | +5 min | 5 min |
| 3 | +10 min | 15 min |
| 4 | +15 min | 30 min |
| 5 | +30 min | 1 hour |
| 6-8 | +1 to +4 hours | 8 hours |
| 9-12 | +8 to +48 hours | ~4 days |
| After 12 | — | Marked as failed |
After 12 failed attempts (~4 days), the message is marked as failed. You can still manually redeliver it from the messages page.
Common failure reasons
Connection refused
- Your mail server is down or unreachable
- The SMTP port (usually 25) is blocked by a firewall
- The hostname in your relay settings is incorrect
Relay rejected
- Your mail server does not accept email from Cleanbox IP addresses. Add Cleanbox to your server’s allowed relay list.
- The destination address does not exist on your server
TLS handshake failed
- Your server requires TLS but the certificate is expired or self-signed. Check your SMTP TLS settings in the relay configuration.
SRS and SPF
Cleanbox uses Sender Rewriting Scheme (SRS) when forwarding relay messages. The envelope-from is rewritten to an @srs.cleanbox.to address so that SPF authentication passes at your destination server. This is automatic — no configuration needed.
If your server rejects messages due to SPF failures, make sure it is checking the envelope-from (which is the SRS address), not the header-from (which is the original sender).
Monitoring delivery
All relay messages appear in your Cleanbox message history with their current status. Filter by status pending to see messages in the retry queue, or failed to see messages that exhausted all retries.
