1
Email Archiving, not saving messages caught by spam filter
Question asked by John Kisha - 2/3/2015 at 12:48 PM
Answered
According to the SmarterMail Storage Help PDF,  email is supposed to be archived immediately when it hits the spool and before it gets to the spam filters.
 
I have a situation where email is being rejected by the spam filter (hardfail of SPF record) and it shows up in the log as being rejected, yet I can't find it when I search the archive. 
 
What might be causing this?
 
Here's the section from the manual:
When archiving is set up for a domain, messages are automatically archived as soon as they hit the spool and before they are handled by any spam and/or content filters.
 
And the link: http://help.smartertools.com/SmarterMail/v10/GeneratePDF.ashx?treeid=256
 
What might be causing this?
 
On a related note, the email address specifically in question has also been added to the trusted sender list, which 'should' cause it to bypass the filters. Unfortunately, it's still getting caught and rejected. 

4 Replies

Reply to Thread
0
Employee Replied
Employee Post
Hello John,
 
Thanks for the information. I'm not certain that you are using the current build of SmarterMail 13x. Please confirm what you observe in the log files and what occurs if the message is rejected. Does the email get delivered despite a failure for the SPF Check ?  I'm not certain why the email would be rejected if the address is on the Trusted Senders list.
 
Please consider opening a Support Ticket and we can review the configurations in more depth.
 
If we find any issues or potential bug we will credit the ticket back.
 
Thank you.
 
0
John Kisha Replied
Yup, current build 13x. 
The log file shows that the email was rejected. (and no, it is not delivered) Here's the log: I took out the client email address.
And, it doesn't come up when searching the archives.
If the report doesn't tell you anything, I'll open the support ticket.
[2015.02.03] 05:06:05 [38.106.41.170][10475745] rsp: 220 email.dandylionhosting.com
[2015.02.03] 05:06:05 [38.106.41.170][10475745] connected at 2/3/2015 5:06:05 AM
[2015.02.03] 05:06:05 [38.106.41.170][10475745] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 05:06:05 [38.106.41.170][10475745] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 05:06:05 [38.106.41.170][10475745] cmd: MAIL FROM:<client@emailaddress.com> SIZE=50826
[2015.02.03] 05:06:10 [38.106.41.170][21249106] rsp: 220 email.dandylionhosting.com
[2015.02.03] 05:06:10 [38.106.41.170][21249106] connected at 2/3/2015 5:06:10 AM
[2015.02.03] 05:06:10 [38.106.41.170][21249106] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 05:06:10 [38.106.41.170][21249106] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 05:06:10 [38.106.41.170][21249106] cmd: MAIL FROM:<client@emailaddress.com> SIZE=50829
[2015.02.03] 05:06:11 [38.106.41.170][10475745] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 05:06:11 [38.106.41.170][10475745] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 05:06:11 [38.106.41.170][21249106] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 05:06:11 [38.106.41.170][21249106] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 05:06:11 [38.106.41.170][10475745] cmd: RSET
[2015.02.03] 05:06:11 [38.106.41.170][10475745] rsp: 250 OK
[2015.02.03] 05:06:11 [38.106.41.170][10475745] disconnected at 2/3/2015 5:06:11 AM
[2015.02.03] 05:06:11 [38.106.41.170][21249106] cmd: RSET
[2015.02.03] 05:06:11 [38.106.41.170][21249106] rsp: 250 OK
[2015.02.03] 05:06:11 [38.106.41.170][21249106] disconnected at 2/3/2015 5:06:11 AM
[2015.02.03] 10:16:52 [38.106.41.170][3168598] rsp: 220 email.dandylionhosting.com
[2015.02.03] 10:16:52 [38.106.41.170][3168598] connected at 2/3/2015 10:16:52 AM
[2015.02.03] 10:16:52 [38.106.41.170][3168598] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 10:16:52 [38.106.41.170][3168598] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 10:16:52 [38.106.41.170][3168598] cmd: MAIL FROM:<client@emailaddress.com> SIZE=12704
[2015.02.03] 10:16:59 [38.106.41.170][3168598] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 10:16:59 [38.106.41.170][3168598] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 10:16:59 [38.106.41.170][3168598] cmd: RSET
[2015.02.03] 10:16:59 [38.106.41.170][3168598] rsp: 250 OK
[2015.02.03] 10:16:59 [38.106.41.170][3168598] disconnected at 2/3/2015 10:16:59 AM
[2015.02.03] 10:19:25 [38.106.41.170][42481856] rsp: 220 email.dandylionhosting.com
[2015.02.03] 10:19:25 [38.106.41.170][42481856] connected at 2/3/2015 10:19:25 AM
[2015.02.03] 10:19:25 [38.106.41.170][42481856] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 10:19:25 [38.106.41.170][42481856] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 10:19:25 [38.106.41.170][42481856] cmd: MAIL FROM:<client@emailaddress.com> SIZE=8656
[2015.02.03] 10:19:31 [38.106.41.170][42481856] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 10:19:31 [38.106.41.170][42481856] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 10:19:31 [38.106.41.170][42481856] cmd: RSET
[2015.02.03] 10:19:31 [38.106.41.170][42481856] rsp: 250 OK
[2015.02.03] 10:19:31 [38.106.41.170][42481856] disconnected at 2/3/2015 10:19:31 AM
0
Joe Wolf Replied
Any message that is SMTP Blocked will not be archived because the message was never accepted. If the message was simply identified as SPAM (not SMTP Blocked) it would be Archived.
Thanks,
-Joe
0
Robert Emmett Replied
Employee Post Marked As Answer
John, when you configure you spam checks as system admin | Security | Antispam Administration, you can specify where the spam check(s) are: 1. enabled for filtering (these are run on messages in the spool); 2. enabled for incoming SMTP blocking; and, 3. enable for outgoing SMTP blocking.
 
As Joe Wolf commented above, if you have a message rejected due SMTP Spam blocking (as the case is above), it will never hit the spool and will not be archived.  I hope this clarifies a little.
Robert Emmett
Software Developer
SmarterTools Inc.
(877) 357-6278
www.smartertools.com

Reply to Thread