Messaging Gateway

We are having a problem when attempting to release legitimate emails from spam quarantine in Brightmail Gateway 9.0.1. If the email is addressed to 25 or less individuals, in or outside our organization, the email gets released. If the email is addressed to 26 or more people the gateway begins the release process and the status bar begins to move. The status bar in the browser window never gets to more than 50% complete when the release operation appears to stall and just disappears. These emails cannot be released from quarantine, I have been copying the contents of the quarantined email to another email and asking the receipent to have the sender resend attachments. The exact same email has arrived with fewer than 26 addressees and can be released while the one with more than 25 addresses can not be released. No error message has been in evidence. the status bar just whites out and the window does not refresh. Any ideas will be welcome.

It sounds like you are reaching some sort of threshold on your mail server for emails going to more than a certain number of recipients.

When you release from quarantine, we use a JavaScript based sender, so it does not go through our normal message process and instead connects directly to the host you have configured for delivery and transmits them.

And SBG doesn't log these "special" connections, so it's hard to perform diagnostics.   Is the JavaScript sender even respecting the connection limits configured in the CC's scanner setup?

No. You can perform a packet capture to see what the conversation looks like if there is limited logging on the mail server's side.

I understand why the CC uses a different component - in case the CC MTA is busted -- but it really should have an exposed logging system and respect connection limits.

I agree that TCPDUMP from the support CLI login would be the way to go to figure out what's happening, but on a very busy CC, this could be a lot of data.  How would I disctinguish the CC Java generated traffic from the scanner component generated traffic?

When you look at the packet capture file in WireShark you can just run a query on the email addresses involved to find the right packet stream.