Jump to content


Suspicious / Deferred in Message Log

  • Please log in to reply
1 reply to this topic

#1 Andrew Rowland

Andrew Rowland
  • Members
  • 1 posts

Posted 06 June 2019 - 10:53 AM

Hi All


We get a number of messages that are Deferred / Not Delivered as Suspicious etc whilst they are awaiting scanning from ATP (Scan First the Deliver)


We have saved searches to quickly identify suspicious messages.  The issue being is that the Message Log will show these with two line actions....once whilst its pending a scan as Not Delivered, the second will show when its successfully delivered, so no longer classed as suspicious.  This can be quite misleading when performing a check to see if anything has been incorrectly tagged, as searching for simply Suspicious emails doesn't show the later Delivered status.


Is there any way of searching for items that have been tagged as Suspicious but not later released when scanned?








#2 Michelle Exner

Michelle Exner

    BSF / BESS Moderator

  • Moderators
  • 374 posts

Posted 06 June 2019 - 05:34 PM

Mail that is pending scan is waiting for two things.

One - for the ATP service to complete the scan 
Two - for the sender to retry the deferred message

ESS does not retry deferred mail. The sender has to retry it.

ALL mail that is deferred has to be retried by the sender

Mail that is marked as suspicious is deferred. ESS thinks it may be a spam attack and so marks it as suspicious. When the mail is retried a few times we will then allow it.


Michelle Exner
Product Lead Support Engineer
Barracuda Email Security
(408) 342-5300