two smg no quarantine release possible

[Michael Lengenfelder]

Hi there,

working on this for mounth, two gateways, both in global DNS (several domains) as MX-records. Priority 10 and 20. Exchange-Servers onpremise.
False positive mail is trapped by gateway#1, mail with the possibility to release or show comes properly to the recipient. After release, site says: successfully released, but mail is not being sent to the reicpients server but to gateway#2, where it´s trapped again and no further mail to the recipient is sent. No chance to get this without admin-support.

It´s a mulit-domain system, both of the gateways has the same settings.

Thanks and best regards, Michael

[alexander smg]

Unclassified | Non classifi?

Unfortunately the knowledge base for smg has been broken for over 90 days. I would reference the article, but the site is broken

[James Martini]

The Broadcom knowledge base is working just fine. Direct links to KBs work the same as they always have but searching now uses an AI front end which may sometimes take 10-15 seconds to generate a response. AI search responses contain direct links to the sources in the KB itself.

Regards,
James Martini
Global Support Lead | Messaging Gateway

[alexander smg]

Unclassified | Non classifi?

Before it would show the latest kb as released. Today, right now shows,


[Image.png]

[alexander smg]

Unclassified | Non classifié

Today it’s shows no articles on support website. Hmm

[alexander smg]

Unclassified | Non classifi?

Does each gateway share the same control centre?

[Michael Lengenfelder]

Hi, nope, each is on its own.

regards, Michael

[Markko Meriniit]

When email is released from quarantine, it is resubmitted again for delivery and I guess it goes and looks for MX record- And as it's one of the MX servers then it sends email to another MX server which is gw2. If Control Center SMTP Settings are "Use existing non-local relay settings" then it's expected behavior I guess. Can you use smarthost there instead?

[alexander smg]

Unclassified | Non classifié

For inbound messages you should not use the mx record for internal delivery. Always use direct ip’s.

[Michael Lengenfelder]

Hi, ok, where to configure IPs for multidomain relay AND release?

Yes, Under Protocols->Domains every single accepted domain is configured with 'Destination Host' and its IP-Address (not MX lookup). Is this that you mean? Nevertheless, released mails use MX and not the configured IP.

Regards, Michael

[alexander smg]

Unclassified | Non classifi?

How do you currently route mail from the internet toward your exchange servers?

[Michael Lengenfelder]

Hi Alexander,

every single domain is configured with its desired mail server-IP.

[alexander smg]

Unclassified | Non classifié

Do you have another MTA (smtp server) available for release? As in under settings, control center, smtp, define new host. That way, you control the release of spam away from SMG.

[Michael Lengenfelder]

Hi, actually, I haven´t. I didn´t now (and cannot clearly imagine) to configure another machine only for releasing mails ... :-)

[alexander smg]

Unclassified | Non classifié

Since the control center holds the quarantine, if you "define new host", it most certainly will work cuz it is NOT being resubmitted to the release back to your internet facing gateways to then shoot it back into exchange. We don't want to make a "u turn", we want to directly land into exchange.

[Michael Lengenfelder]

Hi, understand. Makes it (nearly) clear, but I can only configure one 'new host'. How to route the different domains? There are more mailservers, each for a bunch of domains.

[alexander smg]

Unclassified | Non classifié

No no, your defined MTA will know where to route your other domains spam as required. But at least when it leaves the control center, this next hop that you control will allow you to route anything to any destination. Richer beyond the dreams of averis.

[Michael Lengenfelder]

Makes sense, though, it´s little complicated. Would be easy to release a mail that´s already in the system to its desired mailserver instead of performing a victory lap. But I´ll go for another MTA to route and going to test this.

Thanks for that Alexander, I´ll report.

Best regards, Michael

[alexander smg]

Unclassified | Non classifié

The issue is you cannot control what the control center does after re-submission to the non local scanners. Now when you add the special MTA, even if this new route shoots the mail back towards the same scanners for non-local release (internet) it still works perfectly. And if the release points towards local recipients (e.g. exchange or m365 mailboxes) it still works. And think about this, this other mta has AV, that is just another level av scanning, plus you have another queue at your disposal for delays if network issues arise. And you have another record of release as you can track the message. I have been doing this particular setup for years with 100% success. I always found it weird to have the local spam release go back out to my internet facing scanners to then shoot back in towards my local exchange servers.

[Michael Lengenfelder]

Hi Markko,

yes, as you say, "Use existing non-local relay settings" is active. But, how to lead the released mails to the mailserver for the right domain? What has to be configured to solve this? Non-trapped mails are being delivered perfectly to the configured mailserver for the desired domain.

Best regards, Michael

PS: The behaviour would be fine for me, if the mail is being trapped again. BUT, from the second smg no further quarantine-infomail will be sent. So, the customer is not able to release again. 

[alexander smg]

Unclassified | Non classifi?

Show a pic of how you route mail from internet inter your exchange

[Michael Lengenfelder]

see Post#12

[Michael Lengenfelder]

Hello everybody, finally. I have to say all is working fine now. The exchange is configured to route all desired domains.

The configuration in the smg is changed to send to 'New Host' (which is the IP of my exchange) in Control Center->SMTP.

Thanks to Alex and everybody else and have a good time.

Best regards, Michael

[alexander smg]

Unclassified | Non classifié

So remember, now that the spam email is routed thru exchange upon release, you should make a transport rule within exchange to stamp a header they were released from the control center. Then what you do is bypass that header for the outbound if the destination is NOT local. Why? Cuz the email can be re-seen as spam if you have outbound spam policy is on the smg. Take care

[Michael Lengenfelder]

Hi there,

just want to give a last comment, all is working fine now. The exchange is properly configured to route all desired domains and released mails are sent to the exchange. 

Best, thanks alex and all others, best regards, Michael

[Markko Meriniit]

Hi Micheal,

the setting I talked about is Administration - Settings - Control Center - SMTP tab. And there is "define new host" right under the "Use existing non-local relay settings". You just fill out the host name and port and Control center should forward released emails to this server.

[Michael Lengenfelder]

At least, all is working fine now. Thanks to all for support.

Best regards, Michael

[alexander smg]

Unclassified | Non classifié

So what did you do to fix it?