sonicwall RSS Back to forum
I don't recall if ORF logs anything whitelisted due to a private or immediate host IP address. If not: is the firewall now acting as an SMTP proxy (stamping its own IP address) rather than a mere pass-through filter (retaining the original "Related IP" / "mail from" IP hop)?
@mark:
I share Frank's suspicion: Sonicwall probably rewrites the email header, so ORF thinks all emails are originated from the firewall, and since it is considered a trusted host, it ignores them.
Could you paste a sample email header please so we could check the delivery hops? The MIME header can be retrieved by selecting View | Options in Outlook ("Internet Headers"). Here are some instructions on how to get the MIME headers from other email clients: http://www.spamcop.net/fom-serve/cache/19.html
Do you have any tests assigned to On Arrival (Configuration / Tests / Tests)? If yes, ORF should at least log "email whitelisted" at On Arrival... Are you sure the ORF Service is running?
Also, I suggest turning on logging Before Arrival whitelistings and passes to see if any emails passing through the Before Arrival stage (Configuration / Global / Log and events, ORF Text Log > Configure, Events tab).
I set the firewall up as an intermediate host and I am now seeing entries in the log file! Thanks!
I turned on the RBL on my sonicwall and it appears that ORF is no longer filtering??? When I bring up my orf log viewer there are no entries after the time I enabled the RBL on my firewall.