Hi everyone,

   Users start complaining about missing e-mail messages. First of all, i was wondering what they could do wrong, but after analyzing the situation, i realized that some messages were received, are not held into Spam Quarantine, and it's not delivered to user. I checked Message Audit Logs, and it shows that the message should be into Spam Quarantine, but it's not.

   Example:

   User is expecting to receive a message from aaa@bbb.com.br .

   User checks her Brightmail Profile, and the message from aaa@bbb.com.br is not there.

   I look into the corporative Spam Message Quarantine as administrator, but cannot find the message either.

   I look into the Message Audit Logs, and THERE IS information about the message.

   Log:
 

Message Data
ID: ac140c75-bxxx000005427-d4-4a1477b1aff7
Message-ID: <feb98e9xxxxa94bc0732fbc900339e@sidneygoulart>
Tracker: AAAxxxx+0O9irL
Accepted From: 200.xxx.78.94
Scanners: Local Host
Time accepted: Wednesday, May 20, 2009 06:35:45 PM BRT
Direction: Inbound
Sender: aaa@bbb.com.br
Original recipients: user@mycompany.com.br
Original Subject: proposta para a realização dos eventos
Full attachment list: su serviços brotr - evento rj e sp_junho 2009.pdf, identida visual suda.pdf, green perfomance da estimados.xls
Suspect attachments: None
Recipient Data
Intended recipient: user@mycompany.com.br

Verdict: Verdict Filter Policy Group Details
Suspected spam spam or suspected spam: quarantine message default None

Actions taken: Hold message in Spam Quarantine

Delivery: Delivered To Delivery Time
None

Untested verdicts: Message was sent from a suspect spammer, Locally identified suspected virus, Suspected virus, Content Compliance violation: Delete Executable Files Violations, Content Compliance violation: Delete Email Policy Violations, Content Compliance violation: Legal Disclaimer, Content Compliance violation: Delete True Type Executable Files Violations, Virus attack, Unknown recipient, Connection Class, Default Connection Class, Connection Class 1, Connection Class 2, Connection Class 3, Connection Class 4, Connection Class 5, Connection Class 6, Connection Class 7, Connection Class 8, Connection Class 9, Bounce attack signature present, Bounce Attack, Blocked language, Known language 

   Seems like the message should be at user's Spam Quarantine, but it's not.

   Does it happens to someone else ? Can somebody help ?

   Thanks,

   Carlos Oliveira