When Greylisiting is on, emails rejected because IP address is greylisted

Hi Paul Digby 

Is XG configured in MTA mode?

Would you please share error screenshots?

Did you enable "Sender's IP reputation" in Email?

Yes - MTA Mode
Yes - IP Reputation box ticked
Screenshot not show much in Mail Logs apart from when you hover over 'rejected' it says because IP address 'Grey listed'

Some more information, to confirm 


Its all inbound email that gets rejected
With further testing last night, it would seem after being rejected, the same email is delivered between 5-15 minutes later
If I disable 'grey listing (check box) all email delivered
If I add an exception for an ip address email from that email domain ge delivered


I now have a Sophos Support case [#9310066]

Even a test message from Sophos Support (Sophos.com) was rejected!


Welcome all thoughts / suggestions to resolve this

Hi Paul Digby 

If IP reputation is enabled, it will reject the email from bad reputation IP.

Thank you for sharing case number, I will look into it further.

So every email domain has a bad reputation including Sophos .com


Something not right about that.

Also, the same email that Sophos Support sent as test, was copied to me and I received immediately.

I am using a Sophos Email appliance and it has the same RBL etc settings.

Hi Paul Digby 

I understand your concern, I am just sharing the details related to IP reputation working, there may be some issue and we would help you to assist you further.

Understand, thank you.

Am going to customer site this morning and will be contacting Sophos Support to troubleshoot further.

Do let me know if you have any further thoughts and / or update the case notes

Problem resolve! Well, not a problem but a feature.

Grey lisiting by design works by rejecting the first email and then lets the second through. Its an anti 'bulk send' feature. Details in the link below

https://community.sophos.com/kb/en-us/127568

Greylisting works in this way on all the appliance. The first email is rejected. Many spammer send email without retrying the SMTP connection. In case of Exchange or any other email product, retry timeout and counts are configured, so if the first connection is unreachable, they try with a new connection after the timeout expires.

Always the question: is greylisting worth it? 

You will most likely start to delay certain mails and many users are not happy about that. 

For many users, Email is still a Instant Messaging Service. 

So keep in mind, if you start this, maybe inform your users, that you do it. 

https://en.wikipedia.org/wiki/Greylisting#Advantages

And you have literally no impact on the other side. If the server of the sender is poorly configured, you do not know, when it tries to reach out again. Delay of 6-48 hours are possible...