Soft Bounces are logged in the IronPort Text Mail Logs (mail_logs) and in the Bounce Logs (bounces). The bounce log records all information pertaining to each bounced recipient. In addition, if you have specified message size to log or setup logconfig >logheaders, the message and header information will appear after the bounce information.
The ESA will retry delivery based on the bounceconfig parameters as configured. Delivery will be reattempted at a later time based on the configured maximum number of retries or maximum time in queue.
By default, the system generates a bounce message and sends it to the original sender for each hard bounced recipient. (The message is sent to the address defined in the Envelope Sender address of the message envelope. Envelope From is also commonly referred to as the Envelope Sender.) You can disable this feature and instead rely on log files for information about hard bounces.
Soft bounces become hard bounces after the maximum time in queue or the maximum number of retries, whichever comes first.
Examples of a soft bounce as seen in the mail_logs:
Mon Mar 31 20:10:58 2003 Info: New SMTP DCID 5 interface 172.19.0.11 address 18.104.22.168 Mon Mar 31 20:00:23 2003 Info: Delivery start DCID 3 MID 4 to RID [0, 1] Mon Mar 31 20:00:23 2003 Info: Delayed: DCID 5 MID 4 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.']) Mon Mar 31 20:00:23 2003 Info: Message 4 to RID  pending till Mon Mar 31 20:01:23 2003 Mon Mar 31 20:01:28 2003 Info: DCID 5 close Mon Mar 31 20:01:28 2003 Info: New SMTP DCID 16 interface PublicNet address 172.17.0.113 Mon Mar 31 20:01:28 2003 Info: Delivery start DCID 16 MID 4 to RID  Mon Mar 31 20:01:28 2003 Info: Message done DCID 16 MID 4 to RID  Mon Mar 31 20:01:33 2003 Info: DCID 16 close
Example of a soft bounce as seen in the Bounce log:
Soft-Bounced Recipient (Bounce Type = Delayed) Thu Dec 26 18:37:00 2003 Info: Delayed: 44451135:0 From:<firstname.lastname@example.org> To:<email@example.com> Reason: "4.1.0 - Unknown address error" Response: "('451', ['<firstname.lastname@example.org> Automated block triggered by suspicious activity from your IP address (10.1.1.1). Have your system administrator send e-mail to email@example.com if you believe this block is in error'])"