Milter rejecting emails 'Service unavailable'

[mikcanavan]

All genuine emails are making it through fine - barring one or two domains, which fail with

postfix/cleanup[5184]: warning: milter inet:127.0.0.1:12768: can't read SMFIC_BODYEOB reply packet header: Connection timed out

postfix/cleanup[5184]: 5082A22A8E: milter-reject: END-OF-MESSAGE from XX-XX-202-76.dsl.in-addr.zen.co.uk[XX.XX.202.76]: 4.7.1 Service unavailable - try again later; from=<newsalert@financialexpress.net> to=<nameremoved@domain.co.uk> proto=ESMTP helo=<mailrelayname.co.uk>

Any ideas? Help would be greatly appreciated as this is driving me crazy!

 

[IgorG]

I suspect that this error means that the spam filter needed more than 300s to process the message body. You can increase milter_content_timeout in main.cf as possible solution, but problem may be caused by DNS lookup problems too. Check it at least.

 

[mikcanavan]

So I determined it to NOT be a server issue, as I migrated the domain to Plesk 12 server - and the same error was logged. So after running SPF checks - I spotted that one of the +allow entries for this sender domain was not resolving. The SPF record was as follows (xx added

v=spf1 ip4:87.XX.XX.0/26 ip4:77.XX.XX.0/25 mx a:mx1.messageXXdefence.net a:gs-mail-1.man.hbpXXserver.net a:mailfeed.hbpXXXserver.net a:gs-web-1.man.hbpXXserver.net -all

And then noticed when I validated it…

The result of the test (this should be the default result of your record) was, ambiguous . The explanation returned was, SPF Ambiguity Warning: No A records found for: gs-mail-1.man.hbpXXserver.net

On Plesk 12 however - I see that there is a new option "SPF checking continues when there are DNS lookup problems" which seems to allow this email sender through...

Would this really cause a fail and reject due to an allow not resolving?
Am I opening myself up to more spam by enabling this new option in Plesk 12?