Email Security.cloud

My client's email server failed catastrophically on Fri 6/12.  Luckily, we had Backup Exec System Recovery and got everything back up and running on Monday 6/15.  I told them that their email was fine and that SHMS would start spooling their mail to them after about 15 - 20 minutes.  Well, 1/2 an hour later mail was still not coming down.

So I log into the web console and check the status.  Not in Disaster Recovery mode, which was to be expected.  Checked the Disaster Recovery event log report all affected days (6/10 - 6/15) and -- SURPRISE! -- no entries!  I checked the inbound connections report and the system shows lots of successful connections on 6/11 and then only 6 on 6/12 (the failure happened around 2 in the morning), and then 0 for 6/13 and 6/14, and then multiple successes on 6/15 after the server was back up.

However, on those same days, there are NO failure reported!  So Disaster Recovery (which was set to automatic) never kicked in.

The failed server was the ONLY mail server in the MX list and it was down for close to 4 days, so I don't see how there could NOT have been a failure.

So two questions to Symantec or the general community:

1.  How could SHMS not have realized there was a failure and not kicked in Disaster Recovery?
2.  Where did my client's mail go?

So by default I believe we will start spooling mail after 15 minutes of "down time" or being unable to connect to your mail server.

A question that I would have for you though is, "what status code was being reported back to us, if any?" If we were getting some sort of response back like a 450 try again later, this is what would be reported to us. Not an inability to connect. This could even be given by your firewall depending on all the functions of it.

Most legitimate mail servers will have a time out for messages that were unable to be sent of about 5 days or so. So most likely the mail that was unable to be sent sat at the sending server until your mail server was back up and running.

I agree that under normal circumstances if your mail server is down, SHMS should drop to disaster recovery and spool up your mail. So I do empathize with you. It may be a little bit difficult to do a post mortem and tell you exactly what happened, but let me know if there is anything else that I can help with. Hopefully, we can at least get a direction to look in.

Thanks!
Tom