Error when retell is calling the webhook or any api specified in the tool

Ask Retell Partners
1

When retell is trying to call the inbound webhook or any api sometimes it is successfull and sometimes i get this error

image
image1128×170 28.6 KB

i have checked all the logs and also my load balancer logs…the request is not even reaching the ALB.
This error is very incosistent. There is no proxy enabled

2

Hey, intermittent issues like this where the request never reaches your ALB usually come down to one of three things:

  1. DNS hiccups. Retell’s resolver occasionally fails to look up your ALB. Lifting your DNS TTL to 300 seconds often smooths this out.

  2. TLS handshake failures. If the handshake doesn’t complete, the request never gets logged. Worth checking your ALB’s TLS error metrics in CloudWatch.

  3. Source IP filtering. If your ALB security group restricts traffic to certain IPs and Retell’s outbound IPs rotate, some calls get dropped silently. Try temporarily opening it up to confirm.

What does the actual error message say? That’ll narrow it down quickly. Happy to dig in further once you share it.

Russell

3

Hi there,

Thank you for sharing the logs and details. We reviewed the error:

ECONNRESET: Client network socket disconnected before secure TLS connection was established

This indicates that the connection was reset during the TCP/TLS establishment, before an HTTP request reached the application. Therefore, it may not appear in the application or load balancer access logs.

Key Areas to Check

  1. IPv6 / Dual-Stack DNS

    • Check whether the domain has an AAAA record and whether the ALB is configured for Dualstack.

    • If IPv6 is not required, testing with IPv4-only connectivity can help isolate the issue.

    • Otherwise, verify IPv6 routes, security groups, and port 443 access.

  2. Firewall / WAF / Network Security

    • Check AWS WAF, firewall, or other network-security logs around 2026-02-21 22:50:59 UTC.

    • Look for blocked or rate-limited traffic from Retell’s infrastructure.

  3. TLS Configuration

    • Verify that the ALB HTTPS listener supports modern TLS versions, particularly TLS 1.2 and TLS 1.3.

    • Confirm that the configured security policy is not unnecessarily restrictive.

  4. ALB / TCP Connection Resets

    • In CloudWatch, check:

      • ClientTLSNegotiationErrorCount

      • TCP_Client_Reset_Count

      • TCP_ELB_Reset_Count

    • These metrics can help determine whether the issue is related to TLS negotiation or TCP resets.

If the issue is intermittent, checking these metrics and network logs at the exact failure timestamps should help narrow down where the connection is being reset.

4

Adding on to other comment, you might also need to check how the traefik, allow list, and API wait response on your system. Those might effect why it was not arrive