Cannot receive e-mails from certain domains

Question

We have recently switched over to using the Sophos UTM 9 E-mail Protection and currently are unable to receive e-mails from a few domains including samsung and mail.ru. Our settings are such: 
 
 MX records pointing to our mail server. 
 Mail server points to internal address for the sophos box under send connector. 
 
 We are able to send e-mails to any domain (including samsung and mail.ru) but we cannot receive from them. The only time I could receive from them is when I had a DNAT rule to point to the exchange server (but this only worked because it then bypassed the e-mail protection in sophos altogether). 
 Have I configured something wrong?

DouglasFoster · Accepted Answer

I have configured my UTM in SMTP Standard Mode, and it has worked very well. Others have said that Transparent SMTP should be avoided, without getting into the details of why. 
 The message sender should be receiving a Non-Delivery Report (NDR) from his mail server, which would be helpful for understanding the problem. 
 If the traffic is not getting to the mail server when UTM is in the path, then it is obvious that UTM is blocking the traffic, and my experience is that it is doing so because you have told it to do so. UTM logs nearly everything unless you have told it not to do so. Each firewall rule can selectively enable or disable logging, so you may need to increase logging detail there, although firewall rules do not normally apply to SMTP traffic. 
 Are you using ANY Country Blocking? Since you are having problems with Russia and Korea, country blocking seems like the likely cause. Configuring Country Blocking Exceptions can be tricky. 
 See the RULZ post for information on packet processing sequence, which should help you know which log file to search. 
 See my post in the Management section for a way to parse firewall logs into a SQL database. I have found that SMTP logs are hard to parse into a form that I consider useful, but I have made some recent progress. Send a Private Message if this is of interest. 
 Is UTM your firewall, or do you have a firewall in front of UTM? If something is in front of UTM, the traffic may be blocked there. 
 Similarly, do you have any clould-based email filtering in front of UTM?