I am using a Sophos UTM 9 SG210 firewall and noticed in the SMTP log that a formerly trusted sender has had 50 legitimate emails rejected. I've since added them to an exemption list, but was wondering if there is any way to retrieve those rejected emails? The reason for rejection was SPF check failed.

  • Can you please post some of these log messages exactly like they appeared in log file, probably with the context of some preceeding or following? (You can distort actual sensitive information like email addresses of course). This could help to determine if that was before-queue reject or after-queue. If before-queue, you will not able to recover emails. – Nikita Kipriyanov Jun 9 '16 at 6:06
  • 2
    I don't know anything of your firewall, but typically when a receiving mail server rejects messages during the SMTP session, the message is not accepted and not stored locally, but that message remains the responsibility of the sending mailserver which usually means the message gets returned to sender. So no, most likely you can't retrieve those messages. – HBruijn Jun 9 '16 at 6:07
  • HBruijn: latter depends on how email was rejected. If that was 4xx reject code, it means "temporary error" and sending server should retry delivery later. If that was 5xx code, which means "hard error", the sending server must not try to deliver this message again. And which code is used is completely up to reception server configuration. That is why I ask for logs. – Nikita Kipriyanov Jun 9 '16 at 6:13
  • In either case the sending mailserver is still responsible for the original message because your incoming mailserver did not accept the message for delivery, right? - Ah but you mean if a soft error was given the message might be delivered after a retry? True. – HBruijn Jun 9 '16 at 6:20

SPF checks occur early on in the conversation so the sender (probably) doesn't get a chance to send the email before the attempt is rejected. So no, they're not recoverable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.