FortiMail and invisible Quarantine Email

[Alexander_Mueller]

Hello,

we have a problem with Quarantine Emails.

We are Using Fortimail 200E with v7.0.3(GA), build189

I see the Email in the Logs with Errors but not in the Quarantine

-"System Quarantine;Notification"

-"Milter (mailfilterd): timeout before data read, where=eom"

-"UriExpander: Broken pipe while connecting to"

-"MilterTask: endOfMessage: MediaException( 4099 ) , FileMediaImpl.cpp:170, 'Could Not open /var/spool/tmp/mailfilterd_bqwri1571.2905185088'BQueueWriter::write( 4 ) , QueueEntryWriter.cpp:513, MilterException( 4 ) , SessionFinalize.cpp:2443, '26BC7fTp022032-26BC7fTr022032'"

But only with this Email, all other Emails working.

I have no glue whats the problem or how i can release the Email

[Markus_M]

Hi Alexander,

what do you mean by "only this email"? Do you have other mails and logs that just look fine?

It looks like the mail might have been stopped during transfer and hence not written.

Check the sender IP if this belongs to some spam range and what its IP reverse resolves to (nslookup thatIP). If you have the sender email address, you will also be able to take that domain name and look it up at some mail toolbox for blacklist lookups.

Best regards,

Markus

[AEK]

In which logs did you found that? Can you post a screenshot?

[Alexander_Mueller]

HI,

its from the company yokoy.ai, emails without attachmend or url we can recieve, but if they send attachmend (for example invite) the fortimail sends this email to quarantine and our user get a quarantine-message, but in the quarantine theres no email from this  sender.

If i search in fortimail under monitor-log for this emails, i can see and if i open the Log from this emails, i see the errors

[AEK]

Hello Alexander

Actually I think it is not normal that this mail is quarantined and then not found in quarantine folder. Also the logs you shared I have never seen before on FML, they look like debug logs probably generated due to a bug, not related with regular filtering logs.

On the other hand please share session logs for of this quarantined mail, to check first why the mail was quarantined.

Then, depending on which check has quarantined the mail, you can either whitelist the source domain or create new profile/policy for the sender.

[SREAdmin]

Hi there Alexander. Did you  ever get this resolved? I am experiencing the same issues with a user.

Thanks for your response!

[AEK]

Hi

Which firmware version?

[SREAdmin]

I am running version:

v7.0.2(GA)

[AEK]

7.0.2 is not mature and has many known issues.

I'd suggest to update to 7.0.7 as it will probably fix your issue.

[SREAdmin]

Thanks! I will try that. Has it resolved this issue before for anyone else?