Spam detection stops due to possible corruption of whitelist entries

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

SMSMSE Premium Antispam (PAS) stops working completely due to possible corruption of whitelist

No spam detection, no error/event logged, spam emails are bypassed directly.

We see following entries in DebugVeiw logs, when testing with spam URLs

 

========================

00018769            5:51:08.514 PM [26140] ********************** DUMPING RECEIVED SMTP MESSAGE PROPERTIES FROM EXCHANGE **********************

00018780            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.FromAddress =  [email protected]

00018781            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MessageId = <[email protected]om>

00018795            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MimeDocument.RootPart.Headers.Return-Path = [email protected]

00018809            5:51:08.514 PM [26140] ********************** PROPERTIES DUMPED FOR SMTP MESSAGE **********************

00018810            5:51:08.514 PM [26140] SMSMSESMTPAgent: SMTP message is inbound; processing for Whitelisting and SPA.

00018811            5:51:08.530 PM [26140] DomainWhitelist: Invalid domain specified (Multiple '@').

00018812            5:51:08.530 PM [26140] SMSMSESMTPAgent: Domain Whitelist is enabled.

00018813            5:51:08.530 PM [26140] DomainWhitelist: Message is domain whitelisted.

00018814            5:51:08.530 PM [26140] SMSMSESMTPAgent: Message whitelisted by SMSMSE; bypassing SPA.

00018815            5:51:08.796 PM [26140] SMSMSERoutingAgent constructor

00018816            5:51:08.796 PM [26140] SMSMSERoutingAgent OnSubmittedMessageHandler

00018817            5:51:08.827 PM [26140] SMSMSERoutingAgent - Content Filtering enabled

00018818            5:51:08.843 PM [26140] SMSMSERoutingAgent - Message direction - Inbound: True, Outbound: False

00018926            5:51:09.077 PM [26140] Submit Successeded

00018927            5:51:09.077 PM [26140] Action Take for Body is :: eNAVELINK_ACTION_CLEAN

00018928            5:51:09.093 PM [26140] [Entering]: MemoryBasedScanning.Dispose()

00018929            5:51:09.093 PM [26140] [Leaving]: MemoryBasedScanning.Dispose()

00018930            5:51:09.093 PM [26140] End of ScanMessage

00018931            5:51:09.093 PM [26140] SMSMSERoutingAgent - adding an AV stamp to the message

00018932            5:51:09.093 PM [26140] SMSMSERoutingAgent End OnSubmittedMessageHandler

=======================================

Emails from any domains are marked as whitelists

Cause

Possible corruption of whitelist entries

Resolution

 

1.      Remove all items from the whitelist.
2.      Make sure the PAS works properly and detects spam emails.
3.      Manually add the email addresses/domains back one by one into the list. Don’t copy and paste all of them from a backup document or so.
4.      Confirm again PAS still works properly.