Message Audit Logs (MAL) show messages deleted with the System Denied IP or the Static deny IP address policy.

Verdict: System Denied IP
Filter Policy: static deny IP address.

The sender's IP address or an IP address that appears in the message Received header is present in the Local Bad Sender IP list.

This is the expected, default behavior for messages with a source IP that is in the Local Bad Sender IP list.

If the connecting or logical IP as shown in the Message Audit Logs do not match the Local Bad Sender IP list in Reputation > IP Reputation Lookup you can determine which IP is generating the verdict as follows:

1. Change the action of the Local Bad Senders IPs policy to Hold Message in Spam Quarantine
2. Review the message headers in the Spam Quarantine (Spam > Spam Message Quarantine) by clicking the Subject and then selecting "Display Full Headers"
3. Look up each IP address in the Received headers using Reputation > IP Reputation Lookup
4. Remove that IP address or matching IP address range from Reputation > Bad Senders > Local Bad Sender IPs
5. Change the action for Local Bad Sender IPs back to the default "Reject SMTP Connection" or the desired policy action