Skip to content
KUVERISMX Security DiagnosticsDeutsch

smtp.session.aborted

SMTP Session Closed by Server

What we check

After STARTTLS the scanner runs a short series of checks over the same session — the relay probe, postmaster@ and abuse@ acceptance, VRFY and EXPN. It reads every reply. A 421 reply, or a connection the server closes, ends the session (RFC 5321 §3.8): the scanner stops sending and records which checks did not run.

What this finding means

The server hung up before the scanner was done. The usual trigger is the scanner's own deliberately failing relay probe: Postfix counts the refused RCPT TO as an error and, once smtpd_hard_error_limit is reached, answers 421 4.7.0 Error: too many errors and disconnects. Nothing is wrong with the server — it is defending itself — but the checks after that point could not be measured on this endpoint.

Why it matters

A transcript that shows commands without answers reads like a broken tool. This finding names the reply that ended the session and lists the checks that did not complete, so the report says "not measured" instead of silently leaving them out.

What to do

Usually nothing. If the skipped checks matter to you, run the scan again later — error limits count per connection — or let the probe complete against a test host with a higher smtpd_hard_error_limit.

How it's graded

Informational, unscored. The checks that did complete keep their findings; the skipped ones are neither passed nor failed.

Evidence example

RCPT TO:<relay-test@relay-test.mxaud.it> → 450 4.1.2 Recipient address rejected (expected)
421 4.7.0 mx01.example Error: too many errors
--- session closed by the server ---

References