Message Actions

If your Barracuda Email Security Service subscription expired more than 60 days ago, your account is marked as Suspended, and email are no longer scanned for spam.

Note: Email is still scanned for viruses.

Message blocked by the Advanced Threat Protection (ATP) cloud-based virus scanning service.

ATP is an advanced virus scanning service which, when enabled on the ATP Settings page, provides additional scanning for the attachment file types you specify.

See also:

• Understanding Advanced Threat Protection Reports 
• Advanced Threat Protection Reports

The Scan Email for Viruses setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the virus scanning service was temporarily unavailable when the message came through.

Note: The message is deferred and retried when the virus scanning service is available.

Barracuda Real-Time System (BRTS) detected a zero-hour spam or virus.

This advanced service detects spam or virus outbreaks even where traditional heuristics and signatures to detect such messages do not yet exist.

Message was sent from a particular IP address on the Barracuda Reputation Block List (BRBL).

A list maintained by Barracuda Central that includes IP addresses of known spammers.

The Enable Cloudscan setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the Cloudscan spam scoring service was temporarily unavailable when the message came through.

Note: The message is deferred and is retried when the Cloudscan service is available.

The message has a password-protected archive attachment.

See settings for Attachment Filter on the Inbound Settings > Content Policies and Outbound Settings > Content Policies pages.

Per settings on the Inbound Settings > Anti-spam/Antivirus page, email from this sender is categorized as not necessarily spam, but rather something that the user may have subscribed to at one time and may no longer wish to receive. For example, newsletters and memberships, or marketing information. Categories supported appear in the Message Log Reason as:

• Email Categorization (corporate)
  Emails sent by a user at an authenticated organization from an MS Exchange Server that involves general corporate communications. Does not include marketing newsletters.
• Email Categorization (transactional)
  Emails related to order confirmations, bills, invoices, bank statements, delivery/shipping notices, and service-related surveys
• Email Categorization (marketing)
  Promotional emails from companies such as Constant Contact
• Email Categorization (mailing lists)
  Emails from mailing lists, newsgroups, and other subscription-based services such as Google and Yahoo! Groups
• Email Categorization (social media)
  Notifications and other emails from social media sites such as Facebook and LinkedIn.

Email Categorization assigns some of these emails to specific categories which the admin can set to allow, block, or quarantine on the Inbound Settings > Anti-spam/Antivirus page.

On the Domains > Settings page, the setting Require TLS to Barracuda from these domains lists domains that must use a TLS connection when connecting to Email Gateway Defense. If a TLS connection was not used, then the inbound message is blocked with a reason of Inbound TLS Required.

The message exceeded the maximum message size allowed by the destination mail server, which rejected the message.

The Barracuda Email Security Service allows messages of up to 300 MB.

When ATP is enabled with the Scan First, Then Deliver option, the message is deferred because attachment scanning is pending.

The mail server retries later to check if the scan is complete and, if it is, delivers the message.

An attachment contained content that matched a Predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message body contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message body contained content that matched a predefined filter exception to HIPAA or Privacy content filters.

See the Outbound Settings > Content Policies page.

The message From address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message header contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message subject contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

The message To/CC address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Sender IP address exceeded maximum number of allowed connections in a half-hour period.

Note: The message is deferred unless the client continues to make connections.

Action was taken because of a rule to block the "From" address that uses your domain.

Content in the subject line matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.

Note: A subject line of Message Has No Content indicates an incomplete SMTP transaction due to a failed connection. The log entry shows the from/to data, but has no header or body content. This mail includes messages that are malformed or are addressed to invalid recipients.

The sender has been blocked per policy set by Barracuda Networks; this action prevents the Barracuda Email Security Service IP address from being blocked. Contact your email administrator if you have questions.

Note: Applies to outbound mail.

On the Outbound Settings > DLP/Encryption page, a TLS connection must be used when connecting to the recipient domains listed. If a TLS connection cannot be established, then the outbound message is not delivered and is blocked, with a reason of TLS Required.

For emails blocked or quarantined in the Message Log, the admin can manually deliver those messages. Once the message is delivered, the reason code for that message displays as Allowed with a reason of UI Delivered.

Search for blocked messages. Messages are blocked due to a policy specified on the Inbound Settings and Outbound Settings pages.

Search for deferred messages. Indicates that the Barracuda Email Security Service returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

• The destination mail server was offline. For inbound email, if Spooling is enabled, then the messages would be spooled and not deferred, until the server is reachable. See Email Spooling below for more information.
• The recipient was not valid.
• The destination mail server returned a 4xx response (try later).
• Rate control. See Inbound Rate Control for how rate control is applied to inbound email.
• The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.

Search for blocked messages. Messages are blocked due to policies specified on the Inbound Settings and Outbound Settings pages.

Search for deferred messages. Indicates that the Barracuda Email Security Service returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

• The destination mail server was offline.
• The recipient was not valid.
• The destination mail server returned a 4xx response (try later).
• Rate control. See Inbound Rate Control for how rate control is applied to outbound email.
• The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.