I'm experiencing some strange and frustrating email issues.

Our spamfilter forwards to exchange 2007 network load balanced (nlb) CAS servers. CAS1 and CAS2. The NLB config seems correct.

One issue is the CAS1 server does not handle any traffic from spamfilter - this may not be a question for this forum and might not have anything to do with the below issue.

The other issue is using Sawmill to parse spamfilter logs, we see that a piece of email has arrived and was queued; either filtered and accepted or whitelisted BUT the user never  gets it. Using exchange message tracking, which only shows spamfilter traffic on CAS2, we never the email as having been received.

This issue is affecting a few users and it is seeming random, one time a gmail won't be received, hours later, it is.

Any ideas? Any help will be greatly appreciated as this is becoming a big issue.

If you can please zip to our support @ logsat dot com email address SpamFilter's activity logfile for a day this happened, we'll check to see what is happening. Please let us know the to/from email addresses for one or two of these emails, so we can locate them in the logs. If the zip is over 8MB in size, please upload the file to our FTP site, for which I'll send you the login info via a PM.

Hello,

First another question: When spamfilter says an email is accepted or whitelisted and queued, does that mean it has been sent out the spamfilter infrastructure to the mail server?

Here is a log snippet that might help with my accepted but not delivered emails:

This sender is subject to filtering, he's not on any lists.

05/06/10 14:17:25:813 -- (1492) Sending email from TDesmarais@assante.com to sfraser@hialta.ca -- 

Here is a snippet from Sawmill after parsing. 

My questions are: Is the server error Spamfilter or the CAS NLB 10.1.1.45???? Is it the CAS rejecting the spamfilter server or the email?

I really want to know if this is a spamfilter issue or an exchange issue. Fighting a war on 2 fronts isn't fun.

thank you.

Even if the logs say "is accepted" or "whitelisted", it's possible the sender disconnects before completing the email. The "sure" way of determining SpamFilter attempted to forward the email to your destination SMTP server is the line that contains "Sending email from .... to ..., as the following one:

The above is just an "attempt" to forward the email to your server. In this specific case, your destination server at 10.1.1.45 has rejected the above email from SpamFilter, and this is being logged with the entry, which shows in red the specific error string SpamFilter received when attempting to forward the email to 10.1.1.45:

Please note that we pre-released in the registered user area a new build (4.2.4.830) that drastically changes the above NDR behavior, to prevent the generation of NDR emails as much as possible. In v4.2, SpamFilter verifies the existence of the recipient with your destination SMTP server after an email has passed all filtering tests and is about to be delivered. While it is being delivered to your destination SMTP server, SpamFilter puts "on hold" the incoming connection while it ensures that your server will accept the recipient. Should your server reject the "RCPT TO" command (due to a non-existent user, mailbox full, etc), then in this case SpamFilter will relay the same SMTP error back to the sender. This forces the remote server to send the NDR to their customers, and will avoid having SpamFilter generate an NDR email that needs to be sent.

This said, you will need to ensure that your destination SMTP will accept all emails sent to it by SpamFilter, as if this is not done, you risk that emails won't be delivered.

jortmann wrote: My questions are: Is the server error Spamfilter or the CAS NLB 10.1.1.45???? Is it the CAS rejecting the spamfilter server or the email?

I'm not sure what mail server software is running on 10.1.1.45. That mail server is however rejecting SpamFilter's connection attempts with the error "your IP has been found on a block list", and you will thus need to check your mail server's configuration to see what block list is being used that causes these connection attempts to be rejected. 

We do have the issue resolved HOWEVER it's not resolved in my mind. I'm not the exchange admin but have been poking around and see some settings that concern me, I don't fully understand them but understand enough that I think something is off. One of these settings, once disabled, 'fixed' the email issue.  I will also be upgrading Spamfilter soon as we are out of date.

Sorry the below is a little exchange heavy.