Those error messages are related to SPF DNS queries from IMSVA taking too long to be responded by the remote DNS servers, which causes the smtpd service closing the connection due to a timeout.

This timeout is controlled by the Postfix parameter smtpd_policy_service_timeout which is set to 100 seconds by default.

You can verify your currently set value by running the following command:

postconf | grep smtpd_policy_service_timeout


In order to troubleshoot this issue, follow these steps:

1. Check if your firewall is blocking DNS traffic (over UDP and TCP on port 53) coming from IMSVA.

Note: SPF may switch to DNS over TCP when the TXT records of the sender domain are large. The reason for this is the limited size of the DNS packets over UDP.

2. Enable the SPF debug logs in IMSVA:

a. Access IMSVA via SSH using your root credentials.
b. Backup and then open /opt/trend/imss/postfix/etc/postfix/SPFPolicyd/config.ini
c. Change "log_level=2" to "log_level=4" under [globals] section
d. Restart the Postfix service
postfix restart

3. Enable the general debug logs by following the steps in the KB article below:

https://success.trendmicro.com/solution/KA-0008442

4. Start a packet capture to collect the DNS traffic by following the steps in the KB article below:

https://success.trendmicro.com/solution/KA-0005619

In this case you can use the following tcpdump command to capture only the DNS traffic:

tcpdump -i eth0 -s0 -w /var/app_data/troubleShootingIMSVA.pcap "(port 53)"


From the packet capture you may be able to see how long it took for the IMSVA to receive a reply for the DNS queries.
If the issue is related to a network latency you can follow the steps below to increase the smtpd_policy_service_timeout value. For example, the steps below show how to increase that value to 200 seconds:

a. Access IMSVA via SSH using your root credentials
b. Backup and then open /opt/trend/imss/postfix/etc/postfix/main.cf
b. Add the following line:
smtpd_policy_service_timeout = 200
c. Save the file and restart Postfix by running:
postfix restart

Note: If you have multiple IMSVAs you need to follow those steps on each of them.

If none of these steps fix the issue, please contact the Trend Micro Technical support and provide the information gathered at steps 2, 3 and 4.