Messages are refused with "550 5.2.1 Mail from x.x.x.x refused: spam site" with Symantec Mail Security for Microsoft Exchange (SMSMSE) Enabled

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

With Symantec Mail Security for Microsoft Exchange enabled, why are emails being refused with "550 5.2.1 Mail from <sender IP> refused: spam site"?

Symptoms 

• A Realtime Blacklist (RBL) service is configured within SMSMSE.
• All Emails from External sources cannot be received however Email from Internal sources can be received.
   

Conditions

• Exchange version is either 2000 or 2003.

 

Cause

The Real-time blacklist functionality of SMSMSE is blocking these messages.

One of the configured Real-Time Blacklists (RBL) might be unavailable at the moment.

Resolution

Note:  Symantec has no control over third party blacklists, if a third party blacklist is blocking legitimate messages, Symantec cannot change this behavior except to stop using that blacklist provider.
 

Workaround
Perform one of the following steps:

• Remove the Real-time Blacklist (RBL) service.

• If multiple Real-time Blacklist (RBL) services have been added to the SMSMSE configuration and you need to isolate which service is at fault, removing each service individually while testing mail flow will help in achieving this.
   
• To check and correct the spelling of the Real-time Blacklist providers:
  1. Open the SMSMSE Console
  2. Select Policies
  3. Select Blacklist and Whitelist
  4. Under Real-time Blacklist check and correct the spelling of the Real-time Blacklist providers
  5. Click Deploy Changes
     
• Whitelist the sender that is being rejected:
  1. Open the SMSMSE Console
  2. Select Policies
  3. Select Blacklist and Whitelist
  4. Check the box next to Bypass spam detection for messages sent from the following then enter the user name of the sender being rejected, or enter the entire sender domain in the format *@<yourdomain.com>

Technical Information
Disabling Premium AntiSpam does not disable the settings for Blacklist and Whitelist.