Spam detection stops due to possible corruption of whitelist entries
search cancel

Spam detection stops due to possible corruption of whitelist entries

book

Article ID: 161612

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

SMSMSE Premium Antispam (PAS) stops working completely due to possible corruption of whitelist

No spam detection, no error/event logged, spam emails are bypassed directly.

We see following entries in DebugView logs, when testing with spam URLs

 

======================== 

00018769            5:51:08.514 PM [26140] ********************** DUMPING RECEIVED SMTP MESSAGE PROPERTIES FROM EXCHANGE ********************** 
00018780            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.FromAddress =  [email protected]
00018781            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MessageId = <CAOxsz4qgiJWGCZ7rZmhjuM-9ywM2e0kAsimmB4gwHW-1N_-gng@mail.example.com>
00018795            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MimeDocument.RootPart.Headers.Return-Path = [email protected]
00018809            5:51:08.514 PM [26140] ********************** PROPERTIES DUMPED FOR SMTP MESSAGE ********************** 
00018810            5:51:08.514 PM [26140] SMSMSESMTPAgent: SMTP message is inbound; processing for Whitelisting and SPA. 
00018811            5:51:08.530 PM [26140] DomainWhitelist: Invalid domain specified (Multiple '@'). 
00018812            5:51:08.530 PM [26140] SMSMSESMTPAgent: Domain Whitelist is enabled. 
00018813            5:51:08.530 PM [26140] DomainWhitelist: Message is domain whitelisted. 
00018814            5:51:08.530 PM [26140] SMSMSESMTPAgent: Message whitelisted by SMSMSE; bypassing SPA. 
00018815            5:51:08.796 PM [26140] SMSMSERoutingAgent constructor 
00018816            5:51:08.796 PM [26140] SMSMSERoutingAgent OnSubmittedMessageHandler 
00018817            5:51:08.827 PM [26140] SMSMSERoutingAgent - Content Filtering enabled 
00018818            5:51:08.843 PM [26140] SMSMSERoutingAgent - Message direction - Inbound: True, Outbound: False 
00018926            5:51:09.077 PM [26140] Submit Successeded 
00018927            5:51:09.077 PM [26140] Action Take for Body is :: eNAVELINK_ACTION_CLEAN 
00018928            5:51:09.093 PM [26140] [Entering]: MemoryBasedScanning.Dispose() 
00018929            5:51:09.093 PM [26140] [Leaving]: MemoryBasedScanning.Dispose() 
00018930            5:51:09.093 PM [26140] End of ScanMessage 
00018931            5:51:09.093 PM [26140] SMSMSERoutingAgent - adding an AV stamp to the message 
00018932            5:51:09.093 PM [26140] SMSMSERoutingAgent End OnSubmittedMessageHandler 
=======================================

 

Emails from any domains are marked as whitelists

Cause

Possible corruption of whitelist entries

Resolution

 

1.      Remove all items from the whitelist.
2.      Make sure the PAS works properly and detects spam emails.
3.      Manually add the email addresses/domains back one by one into the list. Don’t copy and paste all of them from a backup document.
4.      Confirm again PAS still works properly.