Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 27 subscribers
  • Views 19168 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG MTA Mode - Mail log. Dropping some, passing others

Gary K

#1 I'm having this issue where an email is sent from an external sender to two recipients in our organization and it make it through every time. If that same sender sends the same email to only one recipient, the message is dropped. 

#2 Also having an issue where an email to multiple recipients makes it to some but not others. See screen shot.

 

Ideas anyone?

16.05.5 MR-5 in MTA mode



This thread was automatically locked due to age.
  • 0

    Gary,

    go to advanced shell on XG (option 5 and then option 3) and check inside the following logs:

    cat /var/tslog/awarrenmta.log | grep "recipient address or denied"

    cat /var/tslog/awarrensmtp.log | grep "recipient address or denied"

    You should be able to see more errors.

  • 0 in reply to lferrara

    MTA Log

    MESSAGE Jun 28 14:01:07 [0x20013aca]: [0x20013aca0](kcordova@***.com)SF Policy Action: ACCEPT

    MESSAGE Jun 28 14:37:50 [0x20013d03]: [0xc000654c](kcordova@***.com)SF Policy Action: DROP

    MESSAGE Jun 28 15:08:29 [0x20013edb]: [0x20013edb0] FROM: lbrown@###com , TO: kcordova@***.com

    MESSAGE Jun 28 15:08:29 [0x20013edb]: [0x20013edb0](kcordova@***com)SF Policy Action: ACCEPT

    I see the moment the message was dropped highlighted in red. Moments later an email in the same thread from the same sender was accepted.

     

    SMTP Log

    No results

     

  • 0 in reply to Gary K

    Gary,

    try that:

    cd /var/tslog

    tail -f *.log | grep "email address here"

    Let's see if the reason is written inside another log file.

    Regards

  • 0 in reply to lferrara

    Luciano,

      It's been sitting here for about a half hour. I'll let it go for a while. in the mean while I tried switching from MTA to transparent in the hope emails wouldn't be randomly dropped but I'm getting inundated with spam now. So port 25 is closed until I can figure something out.

     

     

  • 0 in reply to Gary K

    Hi Gary,

    This might not be related, in the last 24 hours i have had similar email issues.

    I have heard there is an open with the calls to the 3rd party RBL service UCEProtect.

    Try disabling the Standard RBL service in your EMAIL - SPAM policy, and see if that helps. 

    Thanks,

    Matt

  • 0 in reply to MattyG

    I'll try and report back with my findings.

    Thanks Matt!

     

    Edit:  7/18/17 So far so good.

    Thanks again!