Email Archiving, not saving messages caught by spam filter

Question asked by John Kisha - 2/3/2015 at 12:48 PM

Answered

According to the SmarterMail Storage Help PDF, email is supposed to be archived immediately when it hits the spool and before it gets to the spam filters.

I have a situation where email is being rejected by the spam filter (hardfail of SPF record) and it shows up in the log as being rejected, yet I can't find it when I search the archive.

What might be causing this?

Here's the section from the manual:
When archiving is set up for a domain, messages are automatically archived as soon as they hit the spool and before they are handled by any spam and/or content filters.

And the link: http://help.smartertools.com/SmarterMail/v10/GeneratePDF.ashx?treeid=256

What might be causing this?

On a related note, the email address specifically in question has also been added to the trusted sender list, which 'should' cause it to bypass the filters. Unfortunately, it's still getting caught and rejected.

4 Replies

Reply to Thread

Employee Replied

2/3/2015 at 1:44 PM

Employee Post

Hello John,

Thanks for the information. I'm not certain that you are using the current build of SmarterMail 13x. Please confirm what you observe in the log files and what occurs if the message is rejected. Does the email get delivered despite a failure for the SPF Check ? I'm not certain why the email would be rejected if the address is on the Trusted Senders list.

Please consider opening a Support Ticket and we can review the configurations in more depth.

If we find any issues or potential bug we will credit the ticket back.

Thank you.

John Kisha Replied

2/3/2015 at 4:05 PM

Yup, current build 13x.

The log file shows that the email was rejected. (and no, it is not delivered) Here's the log: I took out the client email address.
And, it doesn't come up when searching the archives.

If the report doesn't tell you anything, I'll open the support ticket.

[2015.02.03] 05:06:05 [38.106.41.170][10475745] rsp: 220 email.dandylionhosting.com
[2015.02.03] 05:06:05 [38.106.41.170][10475745] connected at 2/3/2015 5:06:05 AM
[2015.02.03] 05:06:05 [38.106.41.170][10475745] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 05:06:05 [38.106.41.170][10475745] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 05:06:05 [38.106.41.170][10475745] cmd: MAIL FROM:<client@emailaddress.com> SIZE=50826
[2015.02.03] 05:06:10 [38.106.41.170][21249106] rsp: 220 email.dandylionhosting.com
[2015.02.03] 05:06:10 [38.106.41.170][21249106] connected at 2/3/2015 5:06:10 AM
[2015.02.03] 05:06:10 [38.106.41.170][21249106] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 05:06:10 [38.106.41.170][21249106] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 05:06:10 [38.106.41.170][21249106] cmd: MAIL FROM:<client@emailaddress.com> SIZE=50829
[2015.02.03] 05:06:11 [38.106.41.170][10475745] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 05:06:11 [38.106.41.170][10475745] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 05:06:11 [38.106.41.170][21249106] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 05:06:11 [38.106.41.170][21249106] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 05:06:11 [38.106.41.170][10475745] cmd: RSET
[2015.02.03] 05:06:11 [38.106.41.170][10475745] rsp: 250 OK
[2015.02.03] 05:06:11 [38.106.41.170][10475745] disconnected at 2/3/2015 5:06:11 AM
[2015.02.03] 05:06:11 [38.106.41.170][21249106] cmd: RSET
[2015.02.03] 05:06:11 [38.106.41.170][21249106] rsp: 250 OK
[2015.02.03] 05:06:11 [38.106.41.170][21249106] disconnected at 2/3/2015 5:06:11 AM
[2015.02.03] 10:16:52 [38.106.41.170][3168598] rsp: 220 email.dandylionhosting.com
[2015.02.03] 10:16:52 [38.106.41.170][3168598] connected at 2/3/2015 10:16:52 AM
[2015.02.03] 10:16:52 [38.106.41.170][3168598] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 10:16:52 [38.106.41.170][3168598] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 10:16:52 [38.106.41.170][3168598] cmd: MAIL FROM:<client@emailaddress.com> SIZE=12704
[2015.02.03] 10:16:59 [38.106.41.170][3168598] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 10:16:59 [38.106.41.170][3168598] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 10:16:59 [38.106.41.170][3168598] cmd: RSET
[2015.02.03] 10:16:59 [38.106.41.170][3168598] rsp: 250 OK
[2015.02.03] 10:16:59 [38.106.41.170][3168598] disconnected at 2/3/2015 10:16:59 AM
[2015.02.03] 10:19:25 [38.106.41.170][42481856] rsp: 220 email.dandylionhosting.com
[2015.02.03] 10:19:25 [38.106.41.170][42481856] connected at 2/3/2015 10:19:25 AM
[2015.02.03] 10:19:25 [38.106.41.170][42481856] cmd: EHLO email3.signaturetravelnetwork.com
[2015.02.03] 10:19:25 [38.106.41.170][42481856] rsp: 250-email.dandylionhosting.com Hello [38.106.41.170]250-SIZE 31457280250-AUTH LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250 OK
[2015.02.03] 10:19:25 [38.106.41.170][42481856] cmd: MAIL FROM:<client@emailaddress.com> SIZE=8656
[2015.02.03] 10:19:31 [38.106.41.170][42481856] rsp: 554 Sending address not accepted due to spam filter
[2015.02.03] 10:19:31 [38.106.41.170][42481856] Mail rejected due to SMTP Spam Blocking: _SPF (Fail)
[2015.02.03] 10:19:31 [38.106.41.170][42481856] cmd: RSET
[2015.02.03] 10:19:31 [38.106.41.170][42481856] rsp: 250 OK
[2015.02.03] 10:19:31 [38.106.41.170][42481856] disconnected at 2/3/2015 10:19:31 AM

Joe Wolf Replied

2/3/2015 at 7:10 PM

Any message that is SMTP Blocked will not be archived because the message was never accepted. If the message was simply identified as SPAM (not SMTP Blocked) it would be Archived.

Thanks, -Joe

Employee Replied

2/5/2015 at 2:55 PM

Employee Post Marked As Answer

John, when you configure you spam checks as system admin | Security | Antispam Administration, you can specify where the spam check(s) are: 1. enabled for filtering (these are run on messages in the spool); 2. enabled for incoming SMTP blocking; and, 3. enable for outgoing SMTP blocking.

As Joe Wolf commented above, if you have a message rejected due SMTP Spam blocking (as the case is above), it will never hit the spool and will not be archived. I hope this clarifies a little.

Back to Community Threads

Please leave this box unchecked

4 Replies

Reply to Thread

Tags

Related Knowledge Base Articles