Mail Being blocked as SPAM

Hello,

yesterday i had the same Problem

Mails from co.uk are marked as SPAM (confirmed)

I created an exception rule for *@*.co.uk. So we can recieve the Mails from our businesspartner.

I also talked with the german Sophos Support and telled that mails are blocked and that my suggestion is that this might come from a bad Pattern.

Firmware : 9.601-5

Pattern: 161489

Greetings

I can confirm this behaviour, most of emails blocked/classified as spam are coming from .co.uk domains

Appreciated that "most" emails are coming from .co.uk domains, but 

but i feel that's a bit like "...most of the icebergs are not in our path captain !!"  :-) 

Lets hope we get some sort of response soon, does Sophos actually monitor these community messages ... ?

https://community.sophos.com/kb/en-us/134082

says to restart the cyrens service or reboot to clear the cache...

no improvement here when doing

Guys I think I've worked out a fix for the issue.

ssh onto the appliance - and then stop both the ctasd services:

/var/mdw/scripts/ctasd_outbound stop

/var/mdw/scripts/ctasd_inbound stop

then before they restart themselves rename the ctasd cache directory:

mv /var/cache/ctasd  /var/cache/ctasd.old

Once the services restart emails seem to be coming through fine.

Guys I think I've worked out a fix for the issue.

ssh onto the appliance - and then stop both the ctasd services:

/var/mdw/scripts/ctasd_outbound stop

/var/mdw/scripts/ctasd_inbound stop

then before they restart themselves rename the ctasd cache directory:

mv /var/cache/ctasd  /var/cache/ctasd.old

Once the services restart emails seem to be coming through fine.

Hi Daniel,

How do I avoid both services restarting themselves while I am renaming the ctasd cache directory or do they only restart themselves when I tell them to?

Thanks

I wrote the rename command in notepad before hand then pasted it in so I could do it before they brought themselves back up.

Didn't work for me either .

Major nightmare as the mails are all going to quarantine, and we are having to release these manually as some clients are getting 1750 mails a day, i cant get the client to release them as no member of staff is trusted to look through all the directors emails (GDPR), and certainly we are not letting directors lose on the UTM (I just clicked everything but nothing worked story...)

HELP !!!!!

Has it worked for you?

renaming the cache directory/file seems to be be critical part

Should restarting the complete unit not clear the cache though  ..? Does anyone know ?

I had files in the /var/cache/ctasd directory dating back to 2015 - the unit has been rebooted multiple times since then so don't think it would have worked. I wasn't in a position to reboot the unit at the moment due to having another site connected over it. 

restarting doesnt help - you need rename/remove the actual cache directory

Is there a document admins can use to access the UTM using Putty SSH for example to step them through the operations required ?

EDIT to say this does appear to have worked on both boxes we were seeing issues on (looks like the second box was a single false positive)

This appears to have worked on one of our boxes, mail flow now appears to be working ok. Have tried on another box and it still appears to be overblocking....go figure!