Odd SMG behavior when Symantec Global Bad Senders is set to Reject SMTP Connection and SMG sits behind another SEG whose IP is on the SMGs internal hosts list

[Andrey Fyodorov]

We have been using our SMG for almost 20 years, it has been our primary external layer internet email gateway the whole time, and it has always had the Symantec Global Bad Senders action set to Reject SMTP Connection, and it worked as expected.

But we made some changes a few months ago and bought Proofpoint, and Proofpoint is now our primary external layer internet email gateay, and SMG sits downstream of Proofpoint.  And our Proofpoint's IPs have been added to our SMG's internal hosts list.

Our SMG's Symantec Global Bad Senders action remained set at Reject SMTP Connection, and I totally expected that it would be rejecting SMTP inbound connections from our Proofpoint based on the header-derived original sender's logical IP address (if that address happens to be on the Symantec Global  Bad Senders list).

But you know what this action did instead?  It simply silently deleted the emails that came from someone on the Symantec Global Bad Senders list.   And it was a legitimate email too, a very important one.

[alexander smg]

Unclassified | Non classifi?

I have had nothing but issues with global bad senders. I had to use external ip reputation services to get better results as the global lists held onto bad IPs too long. However, of any gateway I can have for me, nothing but smg for life.