RBR750 Email Logs

[hunt68]

I have an ORBI RBR750, firmware V4.6.5.14 (latest).  I have Security setup to send me logs via email every hour.  I've been having MS Outlook email issues on my home environment (two laptops, two phones) where I can't send email during certain times of the day (i.e., it is intermittant - it will work for several hours then randomly stop working - the problem will fix itself and things start working again).  It is a POP3 email setup using Ports 995 for incoming mail and 465 for outgoing.  When email send stops working, it stops on all devices at the same time and vice versa.  My phone is android with a Samsung mail client setup IMAP, and it has experiences the same problem.  If I turn Wifi off, I can send mail from my phone when Wifi send mail does not work.  During the last three days I was able to pinpoint when email send would start working again - 6:00 pm CST on the nose.  Email went from not being able to send on wifi to being able to send at 6:00 pm and thereafter.  Someting seems to be getting reset but I don't know where in the network routing the problem is occurring (e.g., ISP or my host email which is smtp.comcast.net).  

    LOG ISSUE:  Any ideas on the email issue would be appreciated.  After doing days of testing, I don't thing the problem is within my private network or with my router.  I think it lies with either my ISP or Comcast.  Nonetheless, with the ORBI Logs, when I send an email through wifi from my phone or my computer, it is not appearing in the Orbi Log.  Under the Orbi Log settings under "Include in Log", I have everything checked including "Attempted access to allowed sites".  When my RBR750 sends the email log to my email address at the scheduled 1 hour interval, that entry does appear confirming to me that all settings appear to be correct.

    So, the question is... why are my successful emails that being sent on Wifi through the Orbi router not appearing in the Orbi Log?

[CrimpOn]

---

@hunt68 wrote:

When my RBR750 sends the email log to my email address at the scheduled 1 hour interval, that entry does appear confirming to me that all settings appear to be correct.

    So, the question is... why are my successful emails that being sent on Wifi through the Orbi router not appearing in the Orbi Log?

---

If I read the question correctly, the Orbi log process that sends the log contents via email puts that entry into the log file. In normal operation, user activities are not written to the log file.

User access to Allowed or Blocked sites will be logged if the Security function Block Sites is enabled. I would guess that most users will not log access to allowed sites, because that would generate zillions of log entries. (maybe even gadzillions!)

Frankly, I am not certain what Netgear means by "sites".

• Web sites (http: & https), but not other protocols, such as IMAP, POP3, Telnet...?
• Any DNS lookup?

I also have not experimented to see if Block Sites works on "reverse DNS", i.,e. if the user uses an actual IP address rather than a DNS lookup.

At one time Blocking Sites was thought to be a means of Parental Control.  Alas, that concept failed years ago and products such as Disney Circle, and SPC were created with more artificial intelligence.

Sorry to ramble on.  The short answer is "the log process does not typically log user sent email activity."

[hunt68]

Thank you the response... what you said makes sense.  

Do you have any comment on the Outlook issue I am having sending email at certain times of the day?  I now think the problem may be related to sleep mode on my Windows 10 laptop when Outllook is open.  I don't think Outlook really goes to sleep in sleep mode and that something is going haywire with email authentication in sleep mode that is causing a block to be put up for security reasons.  Where this block is occurring is a mystery to me, but it seems to clear itself after so many hours.  Do you know of anything in the Orbi router that might cause such a block?  I am not running Netgear Armour on my RBR750.  I can turn my Windows Defender firewall OFF and I still experience the problem (i.e., I don't think the problem is on my PC); plus, my wife's computer and our two phones all lose the ability to send email at the same time.  I'm thinking either the block is occuring with my ISP but most likely with Comcast.  

[FURRYe38]

What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

Is the RBR using ISP DNS or custom? Try custom DNS on the RBR...Cloudfare or Quad9

[CrimpOn]

---

@hunt68 wrote:

Do you have any comment on the Outlook issue I am having sending email at certain times of the day?  I now think the problem may be related to sleep mode on my Windows 10 laptop when Outllook is open.  I don't think Outlook really goes to sleep in sleep mode and that something is going haywire with email authentication in sleep mode that is causing a block to be put up for security reasons.  Where this block is occurring is a mystery to me, but it seems to clear itself after so many hours.  Do you know of anything in the Orbi router that might cause such a block?  I am not running Netgear Armour on my RBR750.  I can turn my Windows Defender firewall OFF and I still experience the problem (i.e., I don't think the problem is on my PC); plus, my wife's computer and our two phones all lose the ability to send email at the same time.  I'm thinking either the block is occuring with my ISP but most likely with Comcast.  

---

Is there an error message that appears when email does not send?  I notice the Xfinity recommended settings for Comcast seem to mirror yours.  Can you change the "Server Timeout" from short to long?

https://www.xfinity.com/support/articles/update-pop3-110-995 

It would be helpful to eliminate laptop sleep mode as a factor. Is it convenient to change the setting to "Never Sleep".

https://www.hellotech.com/guide/for/how-to-keep-laptop-on-when-closed 

[CrimpOn]

I did not see how you get devices to send email after the 6pm break.  Reboot device? Reboot router? Wait?

[Mikey94025]

---

@hunt68 wrote:

Someting seems to be getting reset but I don't know where in the network routing the problem is occurring (e.g., ISP or my host email which is smtp.comcast.net).  

---

I think it would be useful to first narrow the root cause to either the Orbi or your ISP.  Otherwise we are looking at too many possible problems.

Can you setup your PC so it has internet access without the Orbi?  Then see if it still stops sending mail out until 6:00 pm CST?  That will tell you if it is not the Orbi.

For example, if your phone and cellular plan supports it then enable a hotspot from your phone and connect to that hotspot wifi from your PC.  Now the Orbi is out of the picture, see if your mail goes out.

[hunt68]

My RBR750 firmware version is:   V4.6.5.14_2.0.54

My ONT is Adtran Fiber 410

My Internet Setup - DNS Address setting I've tried both ways. I get the email send errors either way (automatic or custom IP's provided by the ISP)

Error Codes:  There are two Outlook send errors I am getting on my laptop.  95% of the time the error is (0x800CCC0F) : 'The connection to the server was interrupted.'  Occassionally within Outlook I will get:  (0x800CCC67) : '  The server responded: 421 resomta-po-16v.sys.comcast.net resomta-po-16v.sys.comcast.net Excessive failed authentication, ESMTP server temporarily not available'.  

    -- My RBR750 is setup to send me logs hourly via email.  When I can't send email on my laptop, the RBR750 cannot email the log either.  The RBR750 log error that appears in this case is:  [email failed] resomta-c1p-023269.sys.comcast.net resomta-c1p-023269.sys.comcast.net Excessive failed authentication, ESMTP ser Tuesday, Dec 21,2021 17:00:01.

EFFORTS MADE TO ISOLATE THE PROBLEM:  

1.  I have tried every possible fix that can be googled under the error codes mentioned above including triple checking my outlook settings, killing my outlook profile and recreating it from scratch, turning off my MS Defender firewall, installing other anit-virus/malware software and checking for problems (found none and removed these other programs), upgrading Orbi and PC firmware including my netBios, resetting the ORBI to factory settings multiple times along with multiple reboots of it, my PC and the ONT, etc.  None of this has helped.

2.  I have 4 devices that can send email on my home wifi: an iPhone, a Samsung android phone running Samsung Mail app (IMAP), my Dell XPS laptop with Windows 10 running MS Outllook 365 as a POP3 client, wife has Dell XPS with separate email account running same outlook configuration.  When an email send error is noticed on one device, it exists on all four devices (i.e., no device can send email regardless of the email account).  When the send error corrects itself, all four devices are corrected simultaneously.  I.e., they either all work or don't work which I think points to a router problem.  

3.   On my phone, if I disconnect from wifi, I can successfully send mail through my cellular carrier (Verizon).

4.   I can also go onto Comcast's website, log into my email through my browser and send email from there when I can't do so through my outlook client POP3 wifi connection.  

5.   This problem has been going on for months.  It is intermittant meaning that once the send error appears during the day which is usually but not always late morning, it will continue for hours until the problem self-corrects later in the day.  Last Saturday I figured out through testing that whatever is blocking emails being sent clears itself at 6:00 pm CST on the nose.  I was on my laptop at 5:59 pm and repeatedly pressed the mail sync button and got mail send error after error until at 6:00 pm sharp.  At that instant with me doing nothing more than pressing the sync button again, the email that was stuck in my outbox was sent successfully. 

6.  Also this past weekend I suspected the problem might be outlook in sleep mode.  So, I set my PC to never sleep and was careful when I wasn't in outlook to close the application.  I would shut-down my PC at night.  By strictly following this regimen, I've had no send errors for the past two days which is the first time in months that I've gone 24 hours without having a problem.  Then today I slipped, I left my PC powered up but unattended for a couple of hours with Outlook open.  I also reactivated "Automatically send/receive every 15 minutes" which I had turned off since Saturday.  The PC was not in sleep mode, just wasn't being used with Outlook open and auto send/receive on.  When I came back to it the 0x800CCC0F error reoccurred when I tried to send an email.  This was 3:30 pm CST.  I then disconnected the Orbi router from the ONT and plugged the ONT ethernet connection directly into my laptop, and presto, the email stuck in my inbox was sent successfully.  I then reconnected/rebooted the router to the ONT and tried sending an email over wifi and got the 0x800CCC0F again.  I repeated this two step process of connecting my PC directly to the ONT and then back through the router via wifi, and in the first case I can send email and in the second I can't.  Problem therefore must be with the wifi/router connection.

6.  I then got back on my PC at 5:59 pm CST while connected via wifi and starting pressing the mail sync button repeatedly and once again just like this past Saturday right at 6:00 pm CST on the nose whatever was blocking the emails from being sent cleared itself and the email went through.  And as is typical, even now two hours later (8:00 pm) I can still send email through wifi (i.e., once the block is cleared, it is usually cleared the rest of the evening).  

I greatly appreciate anyone who has read this far and is willing to offer suggestions to troubleshoot this issue!  The test today with the direct ethernet connection was telling.  That along with all four devices on my network being affected simultaneously (all can send or none can send) leads to me to believe that the problem is with the RBR750.

REF:  Two weeks ago I started a separate threat on Comcast Xfinity Support Community thinking the problem was a Comcast issue (https://forums.xfinity.com/conversations/email/cannot-send-email-0x800ccc0f-connection-to-server-int...).  At least one user claims he is experiencing the identical issue as me, including having the problem self-correct at 6:00 pm CST.  

[CrimpOn]

If I am correct 6pm CST would be midnight GMT?  An 'interesting' time of day.

I have no personal experience with the 750 series, so any suggestions are just that (suggestions).

How about defining DNS servers in the Windows network properties, which takes Orbi DNS completely out of the picture.

(Suggest 1.1.1.1 and 8.8.8.8)

Does this Orbi have an option on the Advanced Tab, Advanced Settings for Traffic Meter?  It serves no useful purpose for most customers.  Is it enabled or disabled?

Is there any chance that the Security options of Block Sites and/or Block services have been enabled accidentally?

[hunt68]

It is interesting that 6:00 pm CST is 12:00 am GMT.  

The RBR750 does have Advanced Setting-Advanced-Traffic Meter, but mine is disabled.  I have not made any changes to any of the Advanced settings (i.e., all factory default settings).  Metered Connections within my Windows Network Profile is also turned OFF.

Under Security-Block Sites and Block Services, both are set to "NEVER" blocking.  

Defining DNS Servers in Windows Network Properties:  This is an intriguing idea and is something I haven't tried and was completely ignorant of (i.e., I thought I had to use my ISP's DNS servers).  I believe FURRYe38 suggested the same thing but again wasn't clear on what was being suggested.  I read-up on this morning and I think I now get it.  It also appears I can enter these custom DNS server IP's (1.1.1.1, 8.8.8.8, 9.9.9.9, etc.) either within Windows Network Properties or within my RBR750 Advanced-Setup-Internet Setup-DNS Address settings.  Can you help me understand the pluses and minuses of each setting location?  Also, if I make this change on my laptop under Network Properties, will it change the DNS Server settings on all of the devices on my wifi network or just wifi traffic from my laptop (I think it is the former but want to make sure).  

       Secondly, does it make sense that this could be a DNS server issue when you consider that when I am experiencing the send error through my router and then unplug the router and connect my laptop directly to the ONT via ethernet that it then works.  I suppose it does, because when I connect directly to the ONT, the ISP DNS server is seeing a different IP address (my laptop's vs. my router's).  Does that make sense?

Could I just have a bad Orbi RBR750 (i.e., a lemon)?  Have you seen this kind of wierd behavior to find out it was some type of a hardware clitch that required a replacement or do you think this is unlikely?  

BTW, my wifi email sending has been working this morning.  I shutdown my laptop last night and turned auto send/receive off in Outlook.  My hourly Orbit logs were sent successfully throughout the night (the logs were sync'ed/downloaded in a batch this morning to my inbox); however, my Orbi log sent at 7:00 a.m. did fail with the following error (same as before):  '[email failed] resomta-h1p-027916.sys.comcast.net resomta-h1p-027916.sys.comcast.net Excessive f Wednesday, Dec 22,2021 07:00:01.'  Immediately, after seeing this log send failure, I sent a test email to myself from my outlook client at 7:04 a.m. and it did go through successfully.  The next Orbit log at 8:00 a.m. sent successfully. This has happened once before where I would get a random Orbi log email send failure, yet email sending from my laptop would continue to work properly.  

I'm going to let things ride for a while today and see what happens with the email send errors.  I will be leaving the auto send/receive turned off in outlook so as to eliminate this as a variable.  Next in the lineup is try a custom DNS server as suggested.

BTW#2, I am frequently getting "Authentication Failed" errors on ths Netgear Community website (i.e., I will attempt to post a response like this one and sometime they go through and other times I get a "Authentication Failed" response (see attached screen shot).  I wonder if this is a related problem?

[CrimpOn]

Residential routers typically inform devices that they should use the router's IP for DNS queries (through the DHCP process which provides IP address, subnet mask, gateway, etc.)  So, changing the router's DNS settings will affect where the Orbi resolves DNS addresses.

Changing DNS settings in the computer itself overrides the DHCP setting and goes directly from the PC to the designated DNS servers.

That authentication error happens to me all the time when I have closed my web browser and first attempt to connect to the community web page.  My sense is that my browser has cached something, offers it to the web server, and is rejected.  I just click the back arrow, then open the web page again.  It also happens on my smartphone.  Annoying, but I have not spent any time trying to figure it out.

[FURRYe38]

When you see some errors on the NG community page, ether reload the main root page, clear broswer caches and reload the page, clear browser caches, log out, exit the browser then re-open the browser then log back in, or try a different web browser. 

[hunt68]

Significant new developments and progress (I'm hoping)...

1.  Email send errors occurred again immediately after I was away from my PC for two hours.  I had NEVER SLEEP set on my power settings, but not on my screen display.  My screen went to sleep, and when it awakes which I forgot about, it too requires me to log back into my laptop via Windows 10 "Hello" sign-in functionality.  I tried to turn off this Require Sign-in option when my screen awakes but Windows 10 is blocking me from doing so with a message that says "Windows Hello is preventing some options from being shown."  (i.e., a separate issue with MS that I am pursuing).  

2.  I then setup a mobile hotspot on my phone and was able to send email through this hotspot while my wifi IP route was blocked.  I set my laptop to go to sleep to see if I could reproduce the email block so as to eliminate the Orbi router from the equation.  Two hours later, when I got back on my PC, I was still able to successfully send email.  I.e., the problem appears unique to my wifi-router-ISP connection to Comcast.

3.  I changed the DNS Server settings to custom on my RBR750 and input the Cloudflare settings 1.1.1.1 / 1.0.0.1.  During the hours when I was blocked from sending email (prior to 6:00 PM CST), this change did not resolve the problem which I presume makes sense because it was my public IP address that was being blocked.  This also reinforced with me that the block was likely occurring on Comast's end.  I posted this finding in my Comcast Support Community thread and finally, finally, the Comcast admin for that site did confirm that they were blocking my IP address and that every day at 12:00 a.m. GMT, the block is removed.  

4.  At 6:00 pm CST (12:00 am GMT) the block on my address was cleared by Comcast.  Then with the Cloudflare DNS Server entries set on my router, I first confirmed that I could successfully send email.  This worked. I then let my PC got to sleep for two hours.  When it awoke, I WAS STILL ABLE TO SEND EMAIL - NO 0x800CCC0F ERROR!!!  I kept my PC powered up all night with Outlook open, the screen went to sleep, and this morning hours after awaking the PC everything is still working correctly (as of 7:57 a.m.).  So, subject to giving this more testing time with fingers crossed, IT APPEARS THE PROBLEM WAS WITH THE ISP'S DNS SERVER AND SOMETHING GOING HAYWIRE WITH MY COMCAST CONNECTION/AUTHENTICATION FAILING WHEN MY LAPTOP WENT TO SLEEP.  The Cloudflare DNS server does not seem to experience this problem.  

For the experts out there, does it make sense that my ISP's DNS Server could cause this problem while Cloudflare's does not?

Thank you for your help.  I would have never known about the custom DNS settings were it not for those on this support forum.  I will be posting again, hopefully after several days, to confirm that Cloudflare DNS is in fact the solution.  

[FURRYe38]

Ya seems odd that this is happening with ISP DNS and not other DNS. 
I'd contact the ISP support and tell them about this and see why ISP DNS causes this with your PC. 

I'd test a different PC if you have one to compare results...

[FURRYe38]

No. 

[FURRYe38]

If you review this OP responce:

"IT APPEARS THE PROBLEM WAS WITH THE ISP'S DNS SERVER AND SOMETHING GOING HAYWIRE WITH MY COMCAST CONNECTION/AUTHENTICATION FAILING WHEN MY LAPTOP WENT TO SLEEP.  The Cloudflare DNS server does not seem to experience this problem." So this is NOT a FW problem.

[FURRYe38]

It's not always FW. 

[FURRYe38]

I post those as notification for forum users to be aware of new FW. 

I test FW on my own. 

[FURRYe38]

Let us know how this turns out. 

---

@hunt68 wrote:

Significant new developments and progress (I'm hoping)...

1.  Email send errors occurred again immediately after I was away from my PC for two hours.  I had NEVER SLEEP set on my power settings, but not on my screen display.  My screen went to sleep, and when it awakes which I forgot about, it too requires me to log back into my laptop via Windows 10 "Hello" sign-in functionality.  I tried to turn off this Require Sign-in option when my screen awakes but Windows 10 is blocking me from doing so with a message that says "Windows Hello is preventing some options from being shown."  (i.e., a separate issue with MS that I am pursuing).  

2.  I then setup a mobile hotspot on my phone and was able to send email through this hotspot while my wifi IP route was blocked.  I set my laptop to go to sleep to see if I could reproduce the email block so as to eliminate the Orbi router from the equation.  Two hours later, when I got back on my PC, I was still able to successfully send email.  I.e., the problem appears unique to my wifi-router-ISP connection to Comcast.

3.  I changed the DNS Server settings to custom on my RBR750 and input the Cloudflare settings 1.1.1.1 / 1.0.0.1.  During the hours when I was blocked from sending email (prior to 6:00 PM CST), this change did not resolve the problem which I presume makes sense because it was my public IP address that was being blocked.  This also reinforced with me that the block was likely occurring on Comast's end.  I posted this finding in my Comcast Support Community thread and finally, finally, the Comcast admin for that site did confirm that they were blocking my IP address and that every day at 12:00 a.m. GMT, the block is removed.  

4.  At 6:00 pm CST (12:00 am GMT) the block on my address was cleared by Comcast.  Then with the Cloudflare DNS Server entries set on my router, I first confirmed that I could successfully send email.  This worked. I then let my PC got to sleep for two hours.  When it awoke, I WAS STILL ABLE TO SEND EMAIL - NO 0x800CCC0F ERROR!!!  I kept my PC powered up all night with Outlook open, the screen went to sleep, and this morning hours after awaking the PC everything is still working correctly (as of 7:57 a.m.).  So, subject to giving this more testing time with fingers crossed, IT APPEARS THE PROBLEM WAS WITH THE ISP'S DNS SERVER AND SOMETHING GOING HAYWIRE WITH MY COMCAST CONNECTION/AUTHENTICATION FAILING WHEN MY LAPTOP WENT TO SLEEP.  The Cloudflare DNS server does not seem to experience this problem.  

For the experts out there, does it make sense that my ISP's DNS Server could cause this problem while Cloudflare's does not?

Thank you for your help.  I would have never known about the custom DNS settings were it not for those on this support forum.  I will be posting again, hopefully after several days, to confirm that Cloudflare DNS is in fact the solution.  

---

[hunt68]

Since my last posting on 12/24, I have not had a single email send error (i.e., everything is working as it should).  What is odd, however, is that on 12/28, I switched my router settings back from Cloudflares' DNS IP addresses to my ISP's default settings to see if the email send errors would return so as to confirm this was in fact the issue.  The send errors did not return.  I have kept my router settings to the ISP's original default DNS IP settings since 12/28 and have yet to see the email send errors return.  

I am not sure what this means.  I've had many communications with Comcast and my ISP since my issues began.  Perhaps one of them finally made some changes to correct whatever was causing my problem and has not bothered to tell me because they both swore up and down the issue was not on their end.  Maybe the change was account specific as I have seen others post on my Comcast Community Support posting that they continue to experience the same issue.  I checked my Windows 10 update history on my laptop and have not had any updates to my system since 12/24 (i.e., I don't think the fix has anything to do with my PC).  Nonetheless, I am no longer experiencing email send errors and I am continuing to leave my DNS settings set to my ISP's.  

If the errors return, I will post again indicating so.  

[FURRYe38]

Interesting that using custome DNS seems to caus the problem while using ISP DNS doesn't. Not sure if this is a Custom DNS issue or handling of the email configuration thru custom DNS which doesn't seem to be a problem if using ISP DNS. 

Might try using Google DNS or Quad 9 DNS and see if the problem returns. 

Be sure to save off a back up configuration to file for safe keeping. Saves time if a reset is needed.
https://kb.netgear.com/000062080/How-do-I-back-up-the-configuration-settings-on-my-Orbi-WiFi-System

Also new FW is out if your so inclined to try it:

https://community.netgear.com/t5/Orbi-WiFi-6-AX-and-WiFi-6E-AXE/New-RBR750-RBS750-Firmware-Version-v...

[hunt68]

I think you misunderstood my previous response.  I am now not experiencing errors with either custom (Cloudflares') or the ISP's original default DNS IP settings - they both work!   So, it does not appear that it was the DNS settings; instead, the problem appears to have self-corrected either through changes (I'm guessing) made by Comcast or my ISP.    I suppose it was just a coincidence that when I switched to Cloudflare's custom DNS settings and things started working that this occurred at the same time some other fix was implemented by my ISP or Comcast, but at the end of the day I really don't know. 

[FURRYe38]

Ah ok. My bad...

So ya, possible change that the ISP did. 

Well I guess for now it's working and hopefully continue.