Introduction
This document describes what soft bounces are defined as and where soft bounces are recorded to on the Cisco Email Security Appliance (ESA).
Where do I find soft bounce information in the logs?
Soft bounces are emails that are temporarily undeliverable. For example, a user?s mailbox may be full. These messages can be retried at a later time. (e.g., An SMTP 4XX error code.)
Note: For further information on 4XX error codes, please see Simple Mail Transfer Protocol (SMTP) Enhanced Status Codes Registry .
Soft Bounces are logged in the IronPort Text Mail Logs (mail_logs) and in the Bounce Logs (bounces). The bounce log records all information pertaining to each bounced recipient. In addition, if you have specified message size to log or setup logconfig > logheaders, the message and header information will appear after the bounce information.
The ESA will retry delivery based on the bounceconfig parameters as configured. Delivery will be reattempted at a later time based on the configured maximum number of retries or maximum time in queue.
By default, the system generates a bounce message and sends it to the original sender for each hard bounced recipient. (The message is sent to the address defined in the Envelope Sender address of the message envelope. Envelope From is also commonly referred to as the Envelope Sender.) You can disable this feature and instead rely on log files for information about hard bounces.
Soft bounces become hard bounces after the maximum time in queue or the maximum number of retries, whichever comes first.
Examples
Examples of a soft bounce as seen in the mail_logs:
Mon Mar 31 20:10:58 2003 Info: New SMTP DCID 5 interface 172.19.0.11 address
63.251.108.110
Mon Mar 31 20:00:23 2003 Info: Delivery start DCID 3 MID 4 to RID [0, 1]
Mon Mar 31 20:00:23 2003 Info: Delayed: DCID 5 MID 4 to RID 0 - 4.1.0 -
Unknown address error ('466', ['Mailbox temporarily full.'])[]
Mon Mar 31 20:00:23 2003 Info: Message 4 to RID [0] pending till Mon Mar 31
20:01:23 2003
Mon Mar 31 20:01:28 2003 Info: DCID 5 close
Mon Mar 31 20:01:28 2003 Info: New SMTP DCID 16 interface PublicNet address
172.17.0.113
Mon Mar 31 20:01:28 2003 Info: Delivery start DCID 16 MID 4 to RID [0]
Mon Mar 31 20:01:28 2003 Info: Message done DCID 16 MID 4 to RID [0]
Mon Mar 31 20:01:33 2003 Info: DCID 16 close
Example of a soft bounce as seen in the Bounce log:
Soft-Bounced Recipient (Bounce Type = Delayed)
Thu Dec 26 18:37:00 2003 Info: Delayed: 44451135:0
From:<campaign1@yourdomain.com> To:<user@sampledomain.com>
Reason: "4.1.0 - Unknown address error" Response: "('451',
['<user@sampledomain.com> Automated block triggered by suspicious activity
from your IP address (10.1.1.1). Have your system administrator send e-mail
to postmaster@sampledomain.com if you believe this block is in error'])"
Related Information
Feedback