Jump to content


Photo

Suspicious / Deferred in Message Log


This topic has been archived. This means that you cannot reply to this topic.
3 replies to this topic

#1 Andrew Rowland

Andrew Rowland
  • Members
  • 1 posts

Posted 06 June 2019 - 10:53 AM

Hi All

 

We get a number of messages that are Deferred / Not Delivered as Suspicious etc whilst they are awaiting scanning from ATP (Scan First the Deliver)

 

We have saved searches to quickly identify suspicious messages.  The issue being is that the Message Log will show these with two line actions....once whilst its pending a scan as Not Delivered, the second will show when its successfully delivered, so no longer classed as suspicious.  This can be quite misleading when performing a check to see if anything has been incorrectly tagged, as searching for simply Suspicious emails doesn't show the later Delivered status.

 

Is there any way of searching for items that have been tagged as Suspicious but not later released when scanned?

 

Cheers

 

 

 

 

 



#2 Michelle Exner

Michelle Exner

    BSF / BESS Moderator

  • Moderators
  • 409 posts

Posted 06 June 2019 - 05:34 PM

Mail that is pending scan is waiting for two things.

One - for the ATP service to complete the scan 
Two - for the sender to retry the deferred message

ESS does not retry deferred mail. The sender has to retry it.

ALL mail that is deferred has to be retried by the sender

Mail that is marked as suspicious is deferred. ESS thinks it may be a spam attack and so marks it as suspicious. When the mail is retried a few times we will then allow it.

 


Michelle Exner
Product Lead Support Engineer
Barracuda Email Security
(408) 342-5300


#3 Mandy Steininger

Mandy Steininger
  • Members
  • 1 posts

Posted 05 March 2020 - 03:13 AM

Hi Andrew,

 

we have the same question. We would also like to filter the deferred messages to see which didn't get the final delivery.

 

Dear Michelle,

 

Thank you for your great explanation. Is there a way to filter all the deferred emails which were not delivered in the end?

Otherwise if we just check deferred emails and deliver them, the user gets the email twice.

 

Looking forward for your tip.

Thank you in advance.



#4 Michelle Exner

Michelle Exner

    BSF / BESS Moderator

  • Moderators
  • 409 posts

Posted 10 March 2020 - 12:25 PM

Mandy,

Deferred mail in ESS means that the sender will retry the mail until it is delivered or they stop trying

We have no way to show deferred mail that was never delivered and normally you would never want to manually deliver deferred mail.

Mail that fails delivery for ATP and is retried after the 4 hour mark is quarantined so the user will know about it.

Other mail that is deferred and is not retired by the sender is usually (98% of the time) going to be spam and you don't want to deliver that mail.

Users can log into their personal ESS account and review their ALL log and search for deferred mail BUT as noted we do not recommend manually delivering deferred mail unless you are 1000% sure that the mail is actually something you want to receive. 

Sncerely,


Michelle Exner
Product Lead Support Engineer
Barracuda Email Security
(408) 342-5300