Skip to main content

LevelBlue Completes Acquisition of Cybereason.  Learn More

LevelBlue Completes Acquisition of Cybereason.  Learn More

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

PRB: Messages released or forwarded from SEG quarantine are not delivered by Exchange

Expand / Collapse


This article applies to:

  • MailMarshal SEG (issue in release 8.1.2 only)
  • Microsoft Exchange
  • Other email servers that track or block messages based on Message-ID

Symptoms:

  • Messages released or forwarded from SEG quarantine are not delivered by Exchange
  • The issue affects all release methods (Console, SQM, and Digests)

Causes:

  • In SEG 8.1.2, the default behavior is to not change the Message-Id when a message is released from quarantine. This default behavior is a change from all other versions of SEG and MailMarshal.
  • Exchange duplicate message handling might discard the released message as a duplicate if the message was previously delivered to some other users.

Resolution:

You can control the behavior of changing the MessageId, using a registry entry. This entry applies to all versions of SEG, but it should not be changed to the value "1" for most versions..

  1. On the Array Manager, edit the Registry 
  2. Navigate to the SEG Controller key:
    • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Controller
    • For full details of the location for each product version, see article Q10832.
  3. Add or edit a DWORD value DontChangeMessageID
    • To change the ID when a message is released, set the value to 0 (default for most versions).
    • To retain the ID when a message is released, set the value to 1 (default for 8.1.2 only).
  4. Commit configuration changes.
  5. Restart the Controller service on processing servers.

Warning: As always, take due care when editing the Registry. Make a backup before making changes.

Notes:

  • In some cases the "Default" registry key is named "Default(1)" or another version number.

To contact LevelBlue about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.