Email Whitelisted but not going to my Outlook inbox RSS

1

Exchange 2016 CU 9 DAG 2 Nodes
Outlook Client 2013 / 2016

I viewed the ORF Log Viewer and found an email dated 8/27/2018 class Whitelist Severity Information Actions none Filtering Point On Arrival Related ip 10.2.x..x my Exchange server
Sender Recipient


But my outlook client never received the email checked my junk folder and searched no email I have an outlook rule setup to capture that email and place it in a folder.

If it was whitelisted then why did I not receive the email?

Any way to forward that to me?

Thank you

Tom

by Tom 3 weeks ago
2

Hello Tom,

If the email was whitelisted by ORF - and according to your logs, it was - then you should check the message tracking and SMTP protocol logs to see what has happened to the email exactly (most probably an another filtering or anti-virus agent has blocked it). If protocol logging is not enabled on the Send/Receive connectors of your Exchange server, you will need to enable it first: https://technet.microsoft.com/en-us/library/bb124531

By analyzing the delivery route and the protocol logs, you should be able to find the culprit in the delivery chain - and then change its settings. In case you need troubleshooting tips and/or instructions on how to analyze the aforementioned logs, I recommend the following articles:

# Troubleshooting Email Delivery with Exchange Server Protocol Logging: http://practical365.com/exchange-server/exchange-server-protocol-logging/

# Analyzing the protocol logs and Message tracking logs in Exchange: https://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx

Finally, as a general advice, you should make sure that ORF is the very first filtering agent that gets to inspect (and thus log) the incoming emails – this way you will have a complete overview of the incoming traffic. The firing order of the installed mail security agents is controlled by Transport Agent priorities of Exchange. You should assign the highest priority (1), to the "Vamsoft ORF SMTP Receive Agent" as described in the following article: https://vamsoft.com/support/docs/knowledge-base/changing-the-filtering-order

I hope the above proves helpful to you, but please let me know if you have further questions.

by Daniel Novak (Vamsoft) 3 weeks ago
3

@Daniel Novak (Vamsoft): Daniel

I made the change to the filtering Order on both servers.

This in the senders email address


Can I just whitelist this address?

If so need some help doing that

I would like to call and speak to someone about this.

I live in New Jersey USA EST zone available 24 hours a day.

by Tom 2 weeks ago
(in reply to this post)

4

Changing the filtering order will help you monitor the incoming traffic, but it will *not* prevent mail security agents that run after ORF from rerouting or rejecting the emails (i.e. it will not solve the reported issue).

Note, when ORF whitelists an email, it does not guarantee that the email will actually reach the recipient, it just ensures that ORF will not blacklist it. Any other software that runs after ORF and performs anti-virus or mail filtering can still modify or block the email. ORF has no control over this and its logs contain the records of its own filtering actions only - nothing else.

To find out what has happened to the email that was whitelisted by ORF, you will need to analyze the SMTP protocol logs of Exchange. If "verbose" logging is enabled on the receive connectors, you should be able to find the record of the SMTP conversation that happened between your Exchange server and the sending servers when the email in question was submitted for delivery. If the email was refused by your mail server, you will find the reason for it in the SMTP response of your server. If it was accepted, you will need to check the message tracking logs and/or reports to identify the agent or policy that is causing the issue.

If you think that ORF was the culprit in this case, please send us the ORF logs from the day of the incident (e.g. orfee-2018-08-27.log) for analysis. The ORF logs can be found on the configured logging path (default: \Program Files (x86)\ORF Fusion). You may find the service hours of our customer service at https://vamsoft.com/customer-service

by Daniel Novak (Vamsoft) 2 weeks ago

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Nickname:
Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed