CDS for Email Failing Delivery due to size limit in reflect mode

Products

• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention

Issue/Introduction

An email message from O365 coming to a Cloud Detection Server (CDS) is rejected.  In the logs, the following can be seen:

Reason: [{LED=552 5.3.4 Message size exceeds fixed maximum message size [DB5EUR01FT052.eop-EUR01.prod.protection.outlook.com]};{MSG=};{FQDN=smtp-europe-west1-p11-i01-si01.dlp.protect.broadcom.com};{IP=IP ADDRESS};{LRT=7/12/2021 1:51:17 PM}]. OutboundProxyTargetIP: IP ADDRESS OutboundProxyTargetHostName: smtp-europe-west1-p11-i01-si01.dlp.protect.broadcom.com

It is desired to understand why this issue is occurring and if the CDS sets a size limitation on the incoming message or limits detection based on sizing.

 

Environment

Component: DLP CDS for Email in Reflect Mode

Cause

Office 365 has been configured with size limitations.

Resolution

DLP CDS for Email+ doesn't reject emails based on size & CDS for email CDS for email doesn't scan all messages.