# SMTP invalid reply for 221 response **URL:** \ **Category:** Rules\ **Created:** [August 5, 2022, 5:53pm UTC](https://forum.suricata.io/t/smtp-invalid-reply-for-221-response/2680 "2022-08-05T17:53:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![opoplawski](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/opoplawski/32/425_2.png) [@opoplawski](https://forum.suricata.io/u/opoplawski)\ **Post date:** [August 5, 2022, 5:53pm UTC](https://forum.suricata.io/t/smtp-invalid-reply-for-221-response/2680/1 "2022-08-05T17:53:50Z")
We have a public facing mail server and we see a lot of `SMTP invalid reply` alerts when it issues a response like: ```auto 530 5.7.0 Must issue a STARTTLS command first 221 2.0.0 Bye ``` Now, I suppose this is indication of a failed attempt to send mail through it, but it’s not really an “invalid reply” and it’s not unexpected. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [August 29, 2022, 4:07pm UTC](https://forum.suricata.io/t/smtp-invalid-reply-for-221-response/2680/2 "2022-08-29T16:07:01Z")
Do you have a pcap for that or can forge one? That would help to see if it’s a valid trigger or it needs to be extended to detect this as valid traffic