Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Alexander_Mueller
New Contributor

FortiMail and invisible Quarantine Email

Hello,

we have a problem with Quarantine Emails.

 

We are Using Fortimail 200E with v7.0.3(GA), build189

I see the Email in the Logs with Errors but not in the Quarantine

-"System Quarantine;Notification"

-"Milter (mailfilterd): timeout before data read, where=eom"

-"UriExpander: Broken pipe while connecting to"

-"MilterTask: endOfMessage: MediaException( 4099 ) , FileMediaImpl.cpp:170, 'Could Not open /var/spool/tmp/mailfilterd_bqwri1571.2905185088'BQueueWriter::write( 4 ) , QueueEntryWriter.cpp:513, MilterException( 4 ) , SessionFinalize.cpp:2443, '26BC7fTp022032-26BC7fTr022032'"

 

But only with this Email, all other Emails working.

 

I have no glue whats the problem or how i can release the Email

7 REPLIES 7
Markus_M
Staff
Staff

Hi Alexander,

 

what do you mean by "only this email"? Do you have other mails and logs that just look fine?

It looks like the mail might have been stopped during transfer and hence not written.

Check the sender IP if this belongs to some spam range and what its IP reverse resolves to (nslookup thatIP). If you have the sender email address, you will also be able to take that domain name and look it up at some mail toolbox for blacklist lookups.

 

Best regards,

 

Markus

AEK
Honored Contributor

In which logs did you found that? Can you post a screenshot?

AEK
AEK
Alexander_Mueller
New Contributor

HI,

 

its from the company yokoy.ai, emails without attachmend or url we can recieve, but if they send attachmend (for example invite) the fortimail sends this email to quarantine and our user get a quarantine-message, but in the quarantine theres no email from this  sender.

 

If i search in fortimail under monitor-log for this emails, i can see and if i open the Log from this emails, i see the errors

AEK
Honored Contributor

Hello Alexander

 

Actually I think it is not normal that this mail is quarantined and then not found in quarantine folder. Also the logs you shared I have never seen before on FML, they look like debug logs probably generated due to a bug, not related with regular filtering logs.

 

On the other hand please share session logs for of this quarantined mail, to check first why the mail was quarantined.

Then, depending on which check has quarantined the mail, you can either whitelist the source domain or create new profile/policy for the sender.

 

AEK
AEK
SREAdmin
Visitor

Hi there Alexander. Did you  ever get this resolved? I am experiencing the same issues with a user.

Thanks for your response!

AEK
Honored Contributor

Hi

Which firmware version?

AEK
AEK
SREAdmin

I am running version:

v7.0.2(GA)

Labels
Top Kudoed Authors