Scan results explained

The message is rejected by ESG because the sender IP address is listed in at least a public RBL

The message is rejected by ESG because the recipient Dynamic Verification test isn't passed

The message is rejected by ESG because the sender IP address isn't allowed to send emails on behalf of the sender domain (envelope from)

The message is rejected by ESG because the sender email server isn't allowed to use the ESG appliance as relay

The message is rejected by ESG because the sender address isn't valid, it could be a malformed email address

The message is rejected by ESG because the HELO procedure failed

The message is rejected by ESG because is from a sender IP not included in the trusted networks defined in the ESG for the recipient domain

The message is rejected by ESG because the sender domain doesn't exists or the appliance can't resolve it via DNS

The message is rejected by ESG because one or more recipient domain doesn't exist or the appliance can't resolve it via DNS

The message is rejected by ESG because the sender IP address hasn't a PTR record set or the PTR record set doesn't point to the hostname that the server presented with in the HELO process

The message is rejected by ESG because the sender tried to deliver an oversized message to the appliance

The message is rejected by ESG because the sender email server is blocklisted in the the Local RBL service on the appliance. This behavior may be due to a manual RBL blocklist or a dynamic RBL blocklist. The dynamic RBL blocklist happens when an email server sends too many malicious messages. The automatic blocklisting threshold is configurable by the appliance administrator in Mail Transport → Local RBL → Service Configuration page

The message hasn't been scanned by ESG and it's ready for the delivery

The message has been scanned by ESG and it's ready for the delivery

The from address (or the from/to address combination) matched a welcomelist rule. This message hasn't been scanned by ESG and it's ready for the delivery

The message is already scanned by ESG and returned in the incoming scanning queue. This badge could be an email loop warning

The message is quarantined. This badge is usually associated to email that had a scanning timeout. The message scanning timeout is a security feature that prevents ESG to be victim of DoS attacks as some malicious messages are conceived to causes the scanner crash.

If this badge is often applied to legit messages, it could be a warning of a undersized appliance: the appliance may need more resources in order to better manage load peaks.

In order to overcome a legit message marked with this badge, you can rescan the message when the appliance load is lower in order to properly perform the scan avoiding false-positive timeouts.

One or more antimalware engine on the appliance categorized one or more message attachment as infected. The message is quarantined

One or more attachments is blocked by the configured ESG attachment rules

One or more archives attached to the message is blocked because of password encryption. All password encrypted archives are not scannable by ESG

One or more attachments is blocked by the Quicksand engine on ESG

One or more attachments is sanitized by the Quicksand engine (e.g. the active content of the PDF is removed)

The message is quarantined. The message shows one or more impersonation attempts of a configured Whale name in Content Analysis → Impersonation Protection

The message di quarantined. One or more on-board heuristic engine on ESG detected threats inside the message or inside one or more its attachments

The message is quarantined. The message shows one or more impersonation attempts of the sender address or domain

The message is quarantined. The message shows one or more attempts of sensitive information or personal data stealing against the email recipient

The message is quarantined. The message score is greater or equals to the spam value configured in Content Analysis → Anti-Spam Settings → Antispam Action Settings → Spam Levels → Spam Score. The default value is 4.00

The message is quarantined. The message score is greater or equals to the spam value configured in Content Analysis → Anti-Spam Settings → Antispam Action Settings → Spam Levels → High Spam Score. The default value is 10.00

The from address (or the from/to address combination) matched a blocklist rule. This message hasn't been scanned by ESG and has been quarantined

The message matched a user defined dictionary rule. The action performed by ESG depends on the user configuration

The message triggered user defined MCP policy rules. The action performed by ESG depends on the user configuration

The message triggered user defined MCP policy rules and obtained a high MCP score. The action performed by ESG depends on the user configuration