Disabling the temp blacklist took care of this problem.  I had set the "number of allowed bad RCPTs" to 4 in an attempt to catch a bit more spam.  I'm assuming that this particular user was being blacklisted because she was using an outdated distribution list with at least 5 bad RCPTs.

 I had completely overlooked the ability to just turn off the temp blacklist somehow.

Thanks for the support.

I have a Pegasus user (connected to a Mercury server) who called reporting an handshake error.  The error was nondescript to say the least, so I moved on to running the -Z 32 option, and found the actual cause of this piece of lovliness:

 14:25:23.000 >> 0056 421 You are temporarily blacklisted - try again later.\0D\0A

Now the problem is that I have no idea where to go to remove this user from the blacklist, nor how she got on it in the first place.  First things first, though... how do I get her off the <expletive deleted> thing?  The first person to say "restart Mercury" gets my undying love, and by 'undying love', I mean <expletive deleted>.

I have a Pegasus user (connected to a Mercury server) who called

reporting an handshake error.  The error was nondescript to say the

least, so I moved on to running the -Z 32 option, and found the actual

cause of this piece of lovliness:

 14:25:23.000 >> 0056 421 You are temporarily blacklisted - try again later.\0D\0A

It's SMTP.  Happens while trying to send.  The 421 comes back as the EHLO is going out.  I found it interesting that Pegasus handled the error as a handshaking problem (which, in the most generic of terms, it is) instead of mentioning that there was a blacklist issue involved. Not going to bother to restart Mercury tonight, as it's a 3-day weekend and there is a planned power-outage here.  I'll pick this back up on Tuesday, and I'll try not to be too hung over to type.

It is also worth saying that it is a temporary blacklist that resets after 30 mins

Well, it's Tuesday, and my user is still blackisted.  There has been planned power reset of the entire facility over the weekend, so I am no longer dealing with a "temporary" blacklist of any kind.  It looks as though I am going to have to open one of my 10 direct support requests for a rather larger unrelated matter, so I'll lump it in with that one.

Can't you put this user's IP address in the connection control list and allow them?  Are they external?  This is what I do with sending connections and I don't have a problem.

Her entire subnet is allowed in the connection control list.

[edit] and yes, she is external

Have you also excluded the subnet from filtering?

Maybe that's not practical, but if you turn on the session logging for that connection for a while, you should be able to see why it is being blacklisted.