Message Actions

If your Email Gateway Defense subscription expired more than 60 days ago, your account is marked as Suspended, and email are no longer scanned for spam.

Note: Email is still scanned for viruses.

Message blocked by the Advanced Threat Protection (ATP) cloud-based virus scanning service.

ATP is an advanced virus scanning service which, when enabled on the ATP Settings page, provides additional scanning for the attachment file types you specify.

See also:

• Understanding Advanced Threat Protection Reports 
• Advanced Threat Protection Reports

The Scan Email for Viruses setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the virus scanning service was temporarily unavailable when the message came through.

Note: The message is deferred and retried when the virus scanning service is available.

Barracuda Real-Time System (BRTS) detected a zero-hour spam or virus.

This advanced service detects spam or virus outbreaks even where traditional heuristics and signatures to detect such messages do not yet exist.

Message was sent from a particular IP address on the Barracuda Reputation Block List (BRBL).

A list maintained by Barracuda Central that includes IP addresses of known spammers.

The Enable Cloudscan setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the Cloudscan spam scoring service was temporarily unavailable when the message came through.

Note: The message is deferred and is retried when the Cloudscan service is available.

The message has a password-protected archive attachment.

See settings for Attachment Filter on the Inbound Settings > Content Policies and Outbound Settings > Content Policies pages.

Per settings on the Inbound Settings > Anti-spam/Antivirus page, email from this sender is categorized as not necessarily spam, but rather something that the user may have subscribed to at one time and may no longer wish to receive. For example, newsletters and memberships, or marketing information. Categories supported appear in the Message Log Reason as:

• Email Categorization (corporate)
  Emails sent by a user at an authenticated organization from an MS Exchange Server that involves general corporate communications. Does not include marketing newsletters.
• Email Categorization (transactional)
  Emails related to order confirmations, bills, invoices, bank statements, delivery/shipping notices, and service-related surveys
• Email Categorization (marketing)
  Promotional emails from companies such as Constant Contact
• Email Categorization (mailing lists)
  Emails from mailing lists, newsgroups, and other subscription-based services such as Google and Yahoo! Groups
• Email Categorization (social media)
  Notifications and other emails from social media sites such as Facebook and LinkedIn.

Email Categorization assigns some of these emails to specific categories which the admin can set to allow, block, or quarantine on the Inbound Settings > Anti-spam/Antivirus page.

Message blocked by Machine Learning. 

Attackers leverage usernames and passwords stolen in data breaches, using the information to contact and try to trick victims into giving them money. 

The message exceeded the maximum message size allowed by the destination mail server, which rejected the message.

Email Gateway Defense allows messages of up to 300 MB.

When ATP is enabled with the Scan First, Then Deliver option, the message is deferred because attachment scanning is pending.

The mail server retries later to check if the scan is complete and, if it is, delivers the message.

Message blocked by Machine Learning.

Messages sent directly to victims to enter sensitive information such as usernames, passwords, or banking details, on a fake website that looks like a legitimate website. Cybercriminals often use that sensitive information for malicious use.

An attachment contained content that matched a Predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message body contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message body contained content that matched a predefined filter exception to HIPAA or Privacy content filters.

See the Outbound Settings > Content Policies page.

The message From address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message header contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message subject contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message To/CC address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Sender IP address exceeded maximum number of allowed connections in a half-hour period.

Note: The message is deferred unless the client continues to make connections.

Action was taken because of a rule to block the "From" address that uses your domain.

Message blocked by Machine Learning.

Unsolicited bulk email messages, also known as junk email. Spam comes in various forms. Some spam emails push scams. Others are used to conduct email fraud. Spam also comes in the form of phishing emails that use brand impersonation to trick users into revealing personal information, such as login credentials and credit card details.

Content in the subject line matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.

Note: A subject line of Message Has No Content indicates an incomplete SMTP transaction due to a failed connection. The log entry shows the from/to data, but has no header or body content. This mail includes messages that are malformed or are addressed to invalid recipients.

Message deferred or blocked due to multi-level intent checks or Barracuda Anti-Fraud Intelligence checks, as configured on the Inbound Settings > Anti-spam/Antivirus page.

If the sending server retries the message, which indicates the message is most likely not from a spammer, Barracuda Networks will allow the message,

When an email is blocked as suspicious and the mail is legitimate, contact Barracuda Networks Technical Support to let our spam accuracy team know to remove the domain from the intent/suspicious listing.

For mail deferred as suspicious, Barracuda Networks can turn off the suspicious filter upon request. Note that this is not recommended as it can allow more spam to pass through.

The sender has been blocked per policy set by Barracuda Networks; this action prevents Email Gateway Defense IP address from being blocked. Contact your email administrator if you have questions.

Note: Applies to outbound mail.

On the Outbound Settings > DLP/Encryption page, a TLS connection must be used when connecting to the recipient domains listed. If a TLS connection cannot be established, then the outbound message is not delivered and is blocked, with a reason of TLS Required.

For emails blocked or quarantined in the Message Log, the admin can manually deliver those messages. Once the message is delivered, the reason code for that message displays as Allowed with a reason of UI Delivered.

Search for blocked messages. Messages are blocked due to a policy specified on the Inbound Settings and Outbound Settings pages.

Search for deferred messages. Indicates that Email Gateway Defense returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

• The destination mail server was offline. For inbound email, if Spooling is enabled, then the messages would be spooled and not deferred, until the server is reachable. See Email Spooling below for more information.
• The recipient was not valid.
• The destination mail server returned a 4xx response (try later).
• Rate control. See Inbound Rate Control for how rate control is applied to inbound email.
• The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.

Search for blocked messages. Messages are blocked due to policies specified on the Inbound Settings and Outbound Settings pages.

Search for deferred messages. Indicates that Email Gateway Defense returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

• The destination mail server was offline.
• The recipient was not valid.
• The destination mail server returned a 4xx response (try later).
• Rate control. See Inbound Rate Control for how rate control is applied to outbound email.
• The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.