ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Spam detection stops due to possible corruption of whitelist entries

book

Article ID: 161612

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

SMSMSE Premium Antispam (PAS) stops working completely due to possible corruption of whitelist

No spam detection, no error/event logged, spam emails are bypassed directly.

We see following entries in DebugVeiw logs, when testing with spam URLs

 

========================
00018769            5:51:08.514 PM [26140] ********************** DUMPING RECEIVED SMTP MESSAGE PROPERTIES FROM EXCHANGE **********************
00018780            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.FromAddress =  [email protected]
00018781            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MessageId = <[email protected]om>
00018795            5:51:08.514 PM [26140] **********Property EndOfDataEventArgs.MailItem.Message.MimeDocument.RootPart.Headers.Return-Path = [email protected]
00018809            5:51:08.514 PM [26140] ********************** PROPERTIES DUMPED FOR SMTP MESSAGE **********************
00018810            5:51:08.514 PM [26140] SMSMSESMTPAgent: SMTP message is inbound; processing for Whitelisting and SPA.
00018811            5:51:08.530 PM [26140] DomainWhitelist: Invalid domain specified (Multiple '@').
00018812            5:51:08.530 PM [26140] SMSMSESMTPAgent: Domain Whitelist is enabled.
00018813            5:51:08.530 PM [26140] DomainWhitelist: Message is domain whitelisted.
00018814            5:51:08.530 PM [26140] SMSMSESMTPAgent: Message whitelisted by SMSMSE; bypassing SPA.
00018815            5:51:08.796 PM [26140] SMSMSERoutingAgent constructor
00018816            5:51:08.796 PM [26140] SMSMSERoutingAgent OnSubmittedMessageHandler
00018817            5:51:08.827 PM [26140] SMSMSERoutingAgent - Content Filtering enabled
00018818            5:51:08.843 PM [26140] SMSMSERoutingAgent - Message direction - Inbound: True, Outbound: False
00018926            5:51:09.077 PM [26140] Submit Successeded
00018927            5:51:09.077 PM [26140] Action Take for Body is :: eNAVELINK_ACTION_CLEAN
00018928            5:51:09.093 PM [26140] [Entering]: MemoryBasedScanning.Dispose()
00018929            5:51:09.093 PM [26140] [Leaving]: MemoryBasedScanning.Dispose()
00018930            5:51:09.093 PM [26140] End of ScanMessage
00018931            5:51:09.093 PM [26140] SMSMSERoutingAgent - adding an AV stamp to the message
00018932            5:51:09.093 PM [26140] SMSMSERoutingAgent End OnSubmittedMessageHandler
=======================================

Emails from any domains are marked as whitelists

Cause

Possible corruption of whitelist entries

Resolution

 

1.      Remove all items from the whitelist.
2.      Make sure the PAS works properly and detects spam emails.
3.      Manually add the email addresses/domains back one by one into the list. Don’t copy and paste all of them from a backup document or so.
4.      Confirm again PAS still works properly.