Follow

What do the Quarantine Report "Reject Reason" messages mean?

The messages provide good information on why the message was blocked. In some cases, legitimate mail is blocked. When you find a legitimate mail on your Quarantine Report check the Reject Reason and refer to this article for possible steps to take.

You can also view your entire quarantine (messages are kept for approximately 30 days) by following these instructions https://help.mgcld.com/hc/en-us/articles/219012107-Access-your-SPAM-Quarantine-to-Review-and-or-Release-Mail.

Below you will find the most common reject reasons. The reasons may vary slightly in their details as they often are specific to the actual message. However, you should be able to match the reason to this list and determine what steps to take.

 

Found Keywords: [loan,((?im-s)^from:[^:]+@)::NEGATE]

This means that there were keyword variations (in this case loan) and the sender and from addresses were suspect. Whitelisting is the only way to bypass this rule.

 

550 The sender did not meet Sender Policy Framework rules. Please see http://spf.pobox.com

This means that the sender of the message has Sender Policy Framework (SPF) setup on their domain and their settings prevent the mail from being delivered. This is a sender issue and you should send them the block reason so they can correct it.

 

557 The sending server IP 123.197.148.112 is currently listed in SpamFilter ISP's Distributed Blacklist. Please see http://www.logsat.com/SFDB/why.asp for details.

This means that the mail server sending the mail's IP address is on a black list. You should notify the sender and send them the Reject Reason as they should determine why it is on a blacklist. The error shows the IP (123.197.148.112 in this case) and has a link to the black list.

 

URL in the email resolved to a blacklisted IP : (someurl.net) - 521 The IP 123.197.148.112 is Blacklisted by cbl.abuseat.org. locked - see http://www.abuseat.org/lookup.cgi?ip=123.197.148.112 --- ---

This means that the message contains a URL whose IP address is on a public black list. You should notify the sender to not use the URL in their emails or if they are associated with the site, they should determine why it is on a blacklist. The error shows the URL (someurl.net in this case) and has a link to the black list.

 

557 The sender's domain someurl.net does not have a valid MX DNS record.

This means that the domain of the sender (the part after the "@" in the email address) does not have an MX DNS entry. An MX entry is what tells other mail servers how to send mail to the domain. This means that the sender of this message cannot receive email. You should notify the sender so they can resolve this issue.

 

557 The sending server IP 123.197.148.112 does not have a reverse DNS entry

This means that the mail server sending the mail does not have a matching DNS entry for the IP and mail server name. You should notify the sender so they can resolve this issue.

 

SFDE filter match
This means that this sender's mail matched a filter in the known SPAM database. Whitelisting this sender is the only possible resolution.

 

If you do not see the reject reason listed above, open a ticket with support and they can provide an explanation. You can also request that we whitelist the sender for you by opening a ticket with technical support. 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments