Email Whitelisted but not going to my Outlook inbox - ORF Forums

Hello Tom,

If the email was whitelisted by ORF - and according to your logs, it was - then you should check the message tracking and SMTP protocol logs to see what has happened to the email exactly (most probably an another filtering or anti-virus agent has blocked it). If protocol logging is not enabled on the Send/Receive connectors of your Exchange server, you will need to enable it first: https://technet.microsoft.com/en-us/library/bb124531

By analyzing the delivery route and the protocol logs, you should be able to find the culprit in the delivery chain - and then change its settings. In case you need troubleshooting tips and/or instructions on how to analyze the aforementioned logs, I recommend the following articles:

# Troubleshooting Email Delivery with Exchange Server Protocol Logging: http://practical365.com/exchange-server/exchange-server-protocol-logging/

# Analyzing the protocol logs and Message tracking logs in Exchange: https://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx

Finally, as a general advice, you should make sure that ORF is the very first filtering agent that gets to inspect (and thus log) the incoming emails – this way you will have a complete overview of the incoming traffic. The firing order of the installed mail security agents is controlled by Transport Agent priorities of Exchange. You should assign the highest priority (1), to the "Vamsoft ORF SMTP Receive Agent" as described in the following article: https://vamsoft.com/support/docs/knowledge-base/changing-the-filtering-order

I hope the above proves helpful to you, but please let me know if you have further questions.

Changing the filtering order will help you monitor the incoming traffic, but it will *not* prevent mail security agents that run after ORF from rerouting or rejecting the emails (i.e. it will not solve the reported issue).

Note, when ORF whitelists an email, it does not guarantee that the email will actually reach the recipient, it just ensures that ORF will not blacklist it. Any other software that runs after ORF and performs anti-virus or mail filtering can still modify or block the email. ORF has no control over this and its logs contain the records of its own filtering actions only - nothing else.

To find out what has happened to the email that was whitelisted by ORF, you will need to analyze the SMTP protocol logs of Exchange. If "verbose" logging is enabled on the receive connectors, you should be able to find the record of the SMTP conversation that happened between your Exchange server and the sending servers when the email in question was submitted for delivery. If the email was refused by your mail server, you will find the reason for it in the SMTP response of your server. If it was accepted, you will need to check the message tracking logs and/or reports to identify the agent or policy that is causing the issue.

If you think that ORF was the culprit in this case, please send us the ORF logs from the day of the incident (e.g. orfee-2018-08-27.log) for analysis. The ORF logs can be found on the configured logging path (default: \Program Files (x86)\ORF Fusion). You may find the service hours of our customer service at https://vamsoft.com/customer-service