Messaging Gateway

Hello Everyone,

I'm unable to receive mails from senders which I put into Good Senders list. Its very strange, as I think this is standard and very simple configuration, to put addresses into white list. I have put the whole domain in good senders (please find an attached screenshot), but the message is cought and put in quarantine anyways, with very strange verdict:  Content Filtering violation: Sender Authentication: SPF, SenderID Failure: Treat as spam, System allowed email address or domain  (you can find detailed message audit log in a second attachment).

 

Please help to understand, how to put people into whitelist to stop treating them as a spam.

I'm running the current version of SMG - 10.6.6-5.

 

Thanks in advance.

 

In the good sender I wouldn't put *domain.com. I would just put domain.com (that is not critical). Here is what is critical: In your content filter disable the sender ID, dkim, sender auth policies. Then try again. Basically your allow list is getting over ruled by default Symantec content filters.

Hi Alexader,

 

Thanks for your reply. Unfortunately I didn't get mail notification, that someone replied me and today I just checked the post.

 

So, you are saying that I can not use sender authentication togather with white listing? If it's true, than it's very poor capability of the solution. Usualy the white list itself overides all the other policies, so if address is in a white list, spam filter should not check anything else and should pass to to SMTP server.

 

If I disable sender authentication, I'll get a lot of spam mails, as most of them are cought because of this policy. I couldn't believe that this is the only solution  (((

Hi,

Whitelisting has no influence on SPF etc. Whitelisting will, as stated in the documentation i believe only reduced the risk that a mail is caught as spam.

In your case there is an error on sender side generating your behaviour.

What i would do:

1. tell sender correct its error - ip not matching spf etc

2. make a exception for this ip within your content rules treating spf errors as spam: Using the verdict you can find the triggering content rule and by adding the sending ip as an except this sender is passing spf.

I'm using something like this:

Content rule, following conditions must be met: all

    Authentication Results: SPF = fail

    If text in Message header "Received" does not match regular expression ".+aaa\.bbb\.ccc\.ddd.+"

Action: Treat as Spam

 

Hope it helps

Thomas

The default content filters are (spf or dkim) are being triggered by your "safe domain". So either make a special content filter just for the domain to bypass the others, or just turn it off completely.  

 

Either way, forget about fixing the sender domain by telling them anything; you have the power to fix it on your side so do it. Lol

Hello everyone,

 

Thanks you both, for a great explaination, now I understand the logic. I just thought, that the first thing sender was checking on Good Sender List and if it there, then it'll bypass all other filters.

 

OK, so I'll add one more condition into that content policy and it'll do its job. The bad thing about it, is that if I will have several addresses to put there, the condition will became longer and it'll take much more time to proccess it. Not very convinient. Another option is to completly disable the rule, as you mentioned. But, what if mail are cought not by Content Policy, but by Email Spam Policy?

 

I have couple false positive mails every week, which I have to release manually. Unfortunately In Spam policies, there no option for doing exception either put additional condition. Is there any other way, to stop those address to fall under spam (other than fixing mail domain problems on the other side)?

 

Thanks one more time for helping me.

I would just disable the rule. Simpler

You may want to advice sender to fix their SPF records as well

 

Do you quarantine every email that has 'softfail'?

I would not tell anything to the sender. U must accommodate the issue.