We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Essentials

Message Actions

  • Last updated on

The following table describes the actions the Barracuda Email Security Service takes with messages on the Overview > Message Log page.

 Table 1. Message Actions.

ActionDescription
Account Suspended

If your Barracuda Email Security Service subscription expired more than 60 days ago, your account is marked as Suspended, and email are no longer scanned for spam.

Note: Email is still scanned for viruses.

Advanced Threat
Protection

Message blocked by the Advanced Threat Protection (ATP) cloud-based virus scanning service.

ATP is an advanced virus scanning service which, when enabled on the ATP Settings page, provides additional scanning for the attachment file types you specify.

See also:

Anti-FraudBarracuda Anti-Fraud Intelligence detected a potential phishing scheme, which could be used to gather confidential information about an organization or its individual users.
AntivirusThe message had a virus attached.
ATP Service
Unavailable

Message was deferred by the ATP service because the ATP scanning service was temporarily unavailable.

The message is retried and, when the scan is complete, delivered.

Attachment ContentContent in a message attachment matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.
Attachment FilterContent in a message attachment matched an attachment filter defined on either the Inbound Settings > Content Policies or the Outbound Settings > Content Policies page.
AV Service
Unavailable

The Scan Email for Viruses setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the virus scanning service was temporarily unavailable when the message came through.

Note: The message is deferred and retried when the virus scanning service is available.

BRTS

Barracuda Real-Time System (BRTS) detected a zero-hour spam or virus.

This advanced service detects spam or virus outbreaks even where traditional heuristics and signatures to detect such messages do not yet exist.

Barracuda Reputation

Message was sent from a particular IP address on the Barracuda Reputation Block List (BRBL).

A list maintained by Barracuda Central that includes IP addresses of known spammers.

Body ContentMessage body content matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.
Bulk EmailThe Bulk Email Detection setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, and the message qualifies as Bulk.
Cloudscan Service
Unavailable

The Enable Cloudscan setting on the Inbound Settings > Anti-Spam/Antivirus page is set to Yes, but the Cloudscan spam scoring service was temporarily unavailable when the message came through.

Note: The message is deferred and is retried when the Cloudscan service is available.

Content Protected

The message has a password-protected archive attachment.

See settings for Attachment Filter on the Inbound Settings > Content Policies and Outbound Settings > Content Policies pages.

Content URLThe message contained one or more URLs listed in the Intent Domain Policies section on the Inbound Settings > Anti-Phishing page.
DKIM The DomainKeys Identified Mail (DKIM) setting on the Inbound Settings > Sender Authorization page is set to Quarantine or Block and the message is from a domain that fails DKIM verification.
DMARCThe Domain Based Message Authentication (DMARC) setting on the Inbound Settings > Sender Authorization page is Enabled and the message is from a domain that fails DMARC verification.
Email Categorization

Per settings on the Inbound Settings > Anti-spam/Antivirus page, email from this sender is categorized as not necessarily spam, but rather something that the user may have subscribed to at one time and may no longer wish to receive. For example, newsletters and memberships, or marketing information. Categories supported appear in the Message Log Reason as:

  • Email Categorization (corporate)
    Emails sent by a user at an authenticated organization from an MS Exchange Server that involves general corporate communications. Does not include marketing newsletters
  • Email Categorization (transactional)
    Emails related to order confirmations, bills, invoices, bank statements, delivery/shipping notices, and service-related surveys
  • Email Categorization (marketing)
    Promotional emails from companies such as Constant Contact
  • Email Categorization (mailing lists)
    Emails from mailing lists, newsgroups, and other subscription-based services such as Google and Yahoo! Groups
  • Email Categorization (social media)
    Notifications and other emails from social media sites such as Facebook and LinkedIn.

Email Categorization assigns some of these emails to specific categories which the admin can set to allow, block, or quarantine on the Inbound Settings > Anti-spam/Antivirus page.

From Address A sender or content rule for From Address was encountered.
GeoIP PoliciesMessage blocked/quarantined based on a country of origin policy selected on the Inbound Settings > Regional Policies page.
Header ContentContent in the message header matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.
IP Address Policies The sending IP address is listed as Blocked or Exempt on the Inbound Settings > IP Address Policies page.
Image Analysis Image Analysis identified this message as a bulk/spam message.
Intent AnalysisIntention Analysis identified this message as a bulk/spam message.
Invalid RecipientThe To address does not exist on the mail server.
Language PoliciesMessage blocked/quarantined based on a character set selected on the Inbound Settings > Regional Policies page.
Malformed The message did not conform to the SMTP protocol; for example, the Sender, From, Date, or other required fields may be empty.
Message Delivery InterruptedThis error occurs when a sender’s connection drops during email transmission, or if  a sender closes or quits their email editor before email transmission is complete. The message is deferred until the connection resumes and the email is successfully sent.
Message Too Large

The message exceeded the maximum message size allowed by the destination mail server, which rejected the message.

The Barracuda Email Security Service allows messages of up to 300 MB.

No PTR Record Action was taken because:
(1) The Block on No PTR Records setting on the Inbound Settings > Sender Authentication page was set to Yes, and because of (1), the Barracuda Email Security Service queried DNS for the SPF record of the sending domain, and no PTR record was found.
Pending Scan

When ATP is enabled with the Scan First, Then Deliver option, the message is deferred because attachment scanning is pending.

The mail server retries later to check if the scan is complete and, if it is, delivers the message.

Possible Mail LoopIP address for the destination mail server is not correctly configured in the Barracuda Email Security Service, and may instead contain the IP address for the Barracuda Email Security Service, causing a mail loop.
Predefined Attachment
Content

An attachment contained content that matched a Predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Predefined Body
Content

The message body contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Predefined Filter
Exceptions

The message body contained content that matched a predefined filter exception to HIPAA or Privacy content filters.

See the Outbound Settings > Content Policies page.

Predefined From
Address

The message From address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Predefined Header
Content

The message header contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Predefined Subject
Content

The message subject contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Predefined To/CC
Address

The message To/CC address contained content that matched a predefined filter based on data leakage patterns (specific to United States).

See the Outbound Settings > Content Policies page.

Rate Control

Sender IP address exceeded maximum number of allowed connections in a half-hour period.

Note: The message is deferred unless the client continues to make connections.

Realtime BlocklistIP Reputation Analysis determined that the sending IP address is listed on a real-time blocklist (RBL) or DNS blocklist (DNSBL).
RecipientAction was taken because of a rule for the To address.
Score The message score exceeded the Cloudscan Scoring setting on the Inbound Settings > Anti-Spam/Antivirus page.
Sender PoliciesAction was taken because of settings configured on the Inbound Settings > Sender Policies page.
Sender Policy
Framework
The Sender IP address is not listed as an allowed sender for the specified domain using the SPF protocol.
Subject Content

Content in the subject line matched a Message Content Filter rule specified on the Inbound Settings > Content Policies page.

Note: A subject line of Message Has No Content indicates an incomplete SMTP transaction due to a failed connection. The log entry shows the from/to data, but has no header or body content. This mail includes messages that are malformed or are addressed to invalid recipients.

Suspicious Message deferred or blocked due to multi-level intent checks or Barracuda Anti-Fraud Intelligence checks, as configured on the Inbound Settings > Anti-spam/Antivirus page.
System Sender
Policies

The sender has been blocked per policy set by Barracuda Networks; this action prevents the Barracuda Email Security Service IP address from being blacklisted. Contact your email administrator if you have questions.

Note: Applies to outbound mail.

TLS RequiredIf the message is:
  • Inbound
    On the Domains > Settings page, the SMTP over TLS option is set to Yes, meaning that inbound messages must be sent over a TLS connection. If, however, the mail server does not support TLS connections, the inbound message is blocked with a reason of TLS Required.
  • Outbound
    On the Outbound Settings > DLP/Encryption page, the recipient domain is listed, requiring all outbound messages to that domain to be transmitted across a TLS connection. If a TLS connection cannot be established, then the mail is not delivered and is blocked, with a reason of TLS required.
To/CC AddressAction was taken because of a recipient or content rule for To/CC Address.
UI Delivered

For emails blocked or quarantined in the Message Log, the admin can manually deliver those messages. Once the message is delivered, the reason code for that message displays as Allowed with a reason of UI Delivered.

 

When searching for messages in the Message Log, you can use the filters listed in Table 2.

Table 2. Search Filters.

FilterDescription
Inbound Mail
AllowedSearch for delivered messages.
Not AllowedSearch for undelivered messages. To further refine your search, select Blocked, Deferred, or Quarantined.
Blocked

Search for blocked messages. Messages are blocked due to a policy specified on the Inbound Settings and Outbound Settings pages.

Deferred

Search for deferred messages. Indicates that the Barracuda Email Security Service returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

  • The destination mail server was offline. For inbound email, if Spooling is enabled, then the messages would be spooled and not deferred, until the server is reachable. See Email Spooling below for more information.
  • The recipient was not valid.
  • The destination mail server returned a 4xx response (try later).
  • Rate control. See Inbound Rate Control for how rate control is applied to inbound email.
  • The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.
QuarantinedSearch for quarantined messages. Messages are quarantined due to policies specified on the Inbound Settings and Outbound Settings pages.
Outbound Mail
AllowedSearch for delivered messages.
Not AllowedSearch for undelivered messages. To further refine your search, select Blocked, Deferred, or Quarantined.
Blocked

Search for blocked messages. Messages are blocked due to policies specified on the Inbound Settings and Outbound Settings pages.

Deferred

Search for deferred messages. Indicates that the Barracuda Email Security Service returned a 4xx response to the sending mail server. There are several reasons for deferring messages:

  • The destination mail server was offline.
  • The recipient was not valid.
  • The destination mail server returned a 4xx response (try later).
  • Rate control. See Inbound Rate Control for how rate control is applied to outbound email.
  • The administrator can decide to defer messages per policy regarding Content Intent on the Inbound Settings > Anti-Spam/Antivirus page. When a message is deferred due to intent, if the sender retries the message, it is allowed and delivered to the recipient.
QuarantinedSearch for quarantined messages. Messages are quarantined due to policies specified on the Inbound Settings and Outbound Settings pages.
EncryptedSearch for encrypted messages. The Barracuda Email Encryption Service encrypts messages due to policy as specified in the Inbound Settings and Outbound Settings pages. The Barracuda Email Security Service sends the message recipient(s) a notification email directing them to visit the Barracuda Message Center User Guide to retrieve the encrypted message.
 RejectedSearch for rejected messages.

Email Spooling

You can enable Spooling if you want the Barracuda Email Security Service to retain all of your email for up to 96 hours if your mail server goes down. Select Yes to enable or No to disable. If Spooling is set to No and the service cannot connect to your mail server, the mail is deferred and the Delivery Status in the Message Log displays as Not Delivered. The sending mail server, depending on its configuration, has the option of retrying the message or notifying the sender that the mail was deferred or failed.

 

 

Last updated on