Symantec Messaging Gateway is allowing emails from an address listed in the Local Bad Sender Domains list

Products

• Messaging Gateway

Issue/Introduction

An email address has been added to the Local Bad Sender Domains list but the Messaging Gateway is accepting messages from this address with a verdict of "System allowed email address or domain".

Environment

Release : 10.7.X, 10.8.X

Component : Scanner

Cause

This is working as expected. A match to the Local Good Sender Domains list will generate the verdict of "System allowed email address or domain" and Local Good Sender Domains is a stronger verdict than Local Bad Sender Domains. If part of the email address is matching an entry in the Local Good Sender Domains list, it will override the more specific address that has been added to the Local Bad Sender Domains list.

For example, if Local Bad Sender Domains contains the entry "[email protected]" and Local Good Sender Domains contains "example.com", then the Local Good Sender Domain entry would trigger for a message that has sender information from "[email protected]".

Resolution

An important note about Local Sender Domain entries is that both the Envelope MAIL FROM: address and the Body (mail header) From: address are evaluated for matching, so it is important for you to review both addresses for the match. The Message Audit Log displays the Envelope MAIL FROM: address and inspecting the headers of the message will reveal the mail body (header) From: address.

Once you have found the conflict you can remove or clarify the entry so it is not conflicting with your Local Bad Sender Domain entry.