ORF Says Email Rejected, but It's Not - ORF Forums

ORF Says Email Rejected, but It's Not RSS Back to forum

1

I've got an odd issue. I think it started after I upgraded to the newest ORF version (5.4.1) We started seeing a lot of spam in our inboxes. When I check the logs, ORF says the email is getting blocked, but its not. I can check email in the logs based off subject and recipient and ORF says rejected, but somehow the email still hits the exchange inbox. Please help. We're getting TONS of spam. We're running Exchange 2016.

by korry.rogers 2 years ago
2

Hello korry.rogers,

Is it possible that ORF is running in "Test Mode"? In Test Mode, ORF will not actually carry out the filtering actions, but simply log what it would have done to the inspected emails. To see whether this option is enabled or not, navigate to the Filtering > Actions page of the ORF Administration Tool. The "enable Test Mode" checkbox should be unchecked. Press 'Ctrl + S' or select 'File > Save configuration' to ensure that ORF is using the current settings.

If the above is not the case - and you are not using the trial version of ORF - then I suspect another service or filtering agent is interfering with your emails, or the spam is relayed to the recipients via another mail server of yours - and you are not actually looking at the records of the delivered spam in the ORF logs.

To ensure that ORF gets to filter the incoming emails first, make sure that the "Vamsoft ORF SMTP Receive Agent" has the highest priority value (1) assigned to it on the transport agent priority list: https://vamsoft.com/support/docs/knowledge-base/filtering-order-exch2k16

Please let me know if this has helped.

by Daniel Novak (Vamsoft) 2 years ago
3

Yup. That was it. I'm an idiot! Thanks for your help.

by korry.rogers 2 years ago
4

@korry.rogers: I am glad I was able to help :)

by Daniel Novak (Vamsoft) 2 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2