1. Home
  2. Knowledge Base
  3. Enterprise Spam Filter
  4. Common Enterprise Spam Filter Rejected Reasons

The list below is a common listed of Rejected statuses and definitions.

REJECTED

Messages which have been rejected are blocked by the system. Generally these messages can be reviewed in the “Spam quarantine”, from where they can be released. It’s always possible to whitelist the sender to disable any checks and to ensure that the message will get accepted as soon as it’s resent by the sender.


Lines in message were longer than user maximum

This means that line within the email is longer than the set maximum. The RFC 5322 (SMTP 5321) specifies a maximum line length of 998. Normal email clients always enforce this limit to avoid delivery problems. The problem should be resolved at the sender side, or the check can be disabled.


Sending server used an invalid greeting

The sender has used an invalid HELO/EHLO. This could be either because an IP address is used for the HELO, or because the HELO contains an invalid charachter, for example : underscore (_). The RFC states that a FDQN (Fully Qualified Domain Name) MUST be used.


Considered spam

Our systems considered this message as SPAM and quarantined the message. Releasing the message from quarantine will report it as a classification mistake to correct our systems.


SPF failure

This means that the SPF (Sender Policy Framework) has been broken. If this is legitimate mail, then this could be due to a forwarding construction. Please see our SPF knowledgebase article for more information.


Sending server is missing DNS records

The sending server is missing MX records or A records. Please note that any DNS changes only take effect after the initially set TTL has expired.


Destination address does not exist

The destination server is rejecting the connection with a 5xx permanent failure. The logs on the destination server will show why the message was rejected. You’ll have to resolve the problem on the destination server to ensure it accepts the email.


Phishing attempt detected

Our systems detected a phishing attempt. Releasing the message from quarantine will report it as a classification mistake to correct our systems.


Blacklisted sending server

The sending server has been blacklisted on the IP blacklist.


 

Sending server listed on multiple DNSBL

The sending server has been found on mutiple blacklists. Releasing the message from quarantine will report it as a classification mistake to correct our systems. For a temporary override please see http://www.spamrl.com


Sending server attempted too many invalid addresses

The email sending server has attempted to deliver email to too many invalid email addresses in a certain time period. Please retry again later.


Blacklisted sender

The sender was added to the custom sender blacklist.


URLBL

A URL within the email has been listed on several blacklists. Releasing the message from quarantine will report it as a classification mistake to correct our systems. The rejection message contains more information about the responsible list.


 

External Pattern Match

The layout & format of the email matches known spam emails already listed. Releasing the message from quarantine will report it as a classification mistake to correct our systems. The rejection message contains more information about the responsible list.


 

User-specified blackhole address

A user specified a /dev/null Address this email will not get delivered anywhere.


 

Combined Score

The “combined” result provides a weighted classification score of the different classifiers. Depending on the configured “quarantine threshold”, the message will be rejected as spam or accepted. A quarantine threshold of 0.9 is recommended. To be more tollerable for senders using a wrong HELO/PTR/IP configuration, a score of 0.91 can be set. The lower the quarantine threshold, the more messages will be quarantined as spam.


 

CRM114

CRM114 is a statistical content check. When a message gets blocked by this classifier on our systems, then this mean there has been a close match within the email that corresponds to an already seen spam message. Releasing the message from quarantine will report it as a classification mistake to correct our systems.


 

SafebrowsingIn case your message has been rejected with “safebrowsing” in the rejection message, it means it has been (recently) listed by Google as hosting mailicious files.

Was this article helpful?

Related Articles