Discrepancy in Message Audit Logs (MAL) for a single inbound message across different recipients.

Products

• Messaging Gateway

Issue/Introduction

When reviewing the Message Audit Logs (MAL), administrators notice two separate log entries for the exact same inbound email (matching Message-ID, sender, scanner, and timestamp), but with conflicting actions/dispositions:

• Record A: Shows the email was successfully delivered to Recipient A.

• Record B: Shows the email was removed with "System denied IP" verdict for Recipient B.

Cause

This behavior occurs because Symantec Messaging Gateway evaluates messages per Recipient Policy Group.

Resolution

Open 2 Message Audit Logs records side by side and compare Untested Verdicts indicting that 2 different policy groups were involved.