Have you ever wanted to know where that missing message went that you never received? Has an employee said they didn’t receive your email when you think they did? Well now you can find out where they went.
Ensure in MailSite under Server > Logs > Operational Log Flags that you have the following enabled for file log:
• Protocol Exchanges
• Receive Transaction Summary
• Transmit Transaction Summary
• Network Connections
When you next are ‘missing’ a message search that days SMTPRA log file for the senders address e.g. FROM boss@test.com (shown here in green). You should then be able to see the full transaction. I.e. who it was FROM, TO and the subject.
Example SMTPRA Excerpt
2013-06-20 08:58:40.810 UTC [untagged] ( ServerStartStop) The MailSite SMTP Receiver service is starting.
2013-06-20 08:58:44.568 UTC [untagged] ( OperationNetworkConnection) Incoming SMTP call from 127.0.0.1 at 09:58:44.
2013-06-20 08:58:44.572 UTC [untagged] ( OperationProtocol) <<< 220 localhost MailSite ESMTP Receiver Version 10.0.1.5 Ready
2013-06-20 08:58:46.195 UTC [untagged] ( OperationProtocol) >>> ehlo
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) <<< 250-
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-SIZE 13560000
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-ETRN
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-ENHANCEDSTATUSCODES
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-X-IMS 3 23591
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-DSN
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-VRFY
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-AUTH SCRAM-MD5 LOGIN CRAM-MD5
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250-AUTH=LOGIN
2013-06-20 08:58:46.198 UTC [untagged] ( OperationProtocol) ... 250 8BITMIME
2013-06-20 08:58:51.419 UTC [untagged] ( OperationProtocol) >>> mail from:boss@test.com
2013-06-20 08:58:51.421 UTC [untagged] ( OperationProtocol) <<< 250 2.0.0 <boss@test.com> OK
2013-06-20 08:58:58.323 UTC [untagged] ( OperationProtocol) >>> rcpt to:employee@test.com
2013-06-20 08:58:58.325 UTC [untagged] ( OperationProtocol) <<< 250 2.0.0 <employee@test.com> OK
2013-06-20 08:58:59.763 UTC [untagged] ( OperationProtocol) >>> data
2013-06-20 08:58:59.763 UTC [untagged] ( OperationProtocol) <<< 354 Ready for data
2013-06-20 08:59:18.341 UTC [untagged] ( OperationReceivedSummary) Message B0095506419@mail.mydomain.com has Subject: Company Meeting
2013-06-20 08:59:18.342 U [untagged] ( OperationReceivedSummary) Message B0095506419@mail.mydomain.com has Message-ID: <B0095506419@mail.mydomain.com>
2013-06-20 08:59:18.344 UTC [untagged] ( OperationReceivedSummary) Message B0095506419@mail.mydomain.com received at 09:59:18 from (127.0.0.1 [127.0.0.1]), on behalf of authenticated user: [Unauthenticated User].
2013-06-20 08:59:18.344 UTC [untagged] ( OperationReceivedSummary) Message Id: B0095506419@mail.mydomain.com
Size: 369 bytes
Return-path: boss@test.com
Recipients (1): employee@test.com
2013-06-20 08:59:18.344 UTC [untagged] ( OperationProtocol) <<< 250 2.0.0 Message received OK
2013-06-20 08:59:20.180 UTC [untagged] ( OperationProtocol) >>> quit
2013-06-20 08:59:20.180 UTC [untagged] ( OperationProtocol) <<< 221 2.0.0 mail.mydomain.com closing
2013-06-20 08:59:20.180 UTC [untagged] ( OperationNetworkConnection) Incoming SMTP call from 127.0.0.1 completed at 08:59:20
Look for the message ID (It is shown here in yellow) B0095506419 and open the SMTPDA log for the same date. Search to find this ID and note the entries. They may be more than one entry for the ID.
Example SMTPDA Excerpt
2013-06-20 09:07:09.433 UTC [untagged] ( OperationReceivedSummary) Successfully picked up new incoming message: c:\MailSite\SPOOL\incoming\B0095506419.RCP
2013-06-20 09:07:09.440 UTC employee@test.com ( OperationReceivedSummary) MailboxSieveScripts processing completed for message B0095506419.MSG to employee@test.com.
Reject Reason: Message rejected by content filter ID5.
Discard Message
This shows that MailSite picked the message up from the incoming folder and then processed the message through the sieve filters setup. In this instance the message was ‘caught’ by a sieve filter and discarded.
This information can help you see which sieve filter you need to alter to stop incorrectly filtering out email you wish to receive. As you can see when I created my sieve filter I gave it a reject reason (shown in red) and also an ID number in the reject message. I can then use this ID number in my logs to find which of my sieve filter has this in their reject message and thus caught the message and adjust accordingly.
If however you saw this instead. It would indicate that the message was filtered and then sent on to the mailbox. The employee in this case definitely did get the email (shown in pink).
2013-06-20 08:59:18.350 UTC [untagged] ( OperationReceivedSummary) Successfully picked up new incoming message: c:\MailSite\SPOOL\incoming\B0095506419.RCP
2013-06-20 08:59:18.357 UTC employee@test.com ( OperationReceivedSummary) MailboxSieveScripts processing completed for message B0095506419.MSG to employee@test.com.
Keep Message