Too many inbound emails blocked by RBL check

Hello Michael Großmann,

Thank you for reaching out to the community, so may we know were you using the pre-defined RBLs such as standard & premium RBLs OR you are using any custom ?
> Address group: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Email/AddressGroup/index.html
> Add an address group: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Email/AddressGroup/EmailAddressGroupAdd/index.html

Hello Vivek,

we're using only the two pre-defined premium RBLs.

Best regards

Michael

have you checked with one of the sample e-mail where the sender's domain is black-listed or not ? 

Yes, I have checked different email addresses to see if they are on any block list. None of the addresses were on blocklist, there were also many known addresses, which were never rejected in the past.
Many email addresses are sometimes rejected (reason: blacklisted) and sometimes not rejected - even with the same email addresses. I have no idea how this can be.

Best regards

Michael

Okay, is the email protection deployed in Legacy or MTA mode ?
Can you share the debug logs for any one of the mail which was rejected ?

To enable/disable debug: service smtpd:debu -ds nosync
To enable/disable debug: service awarrensmtp:debug -ds nosync
Log file details: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html
Refer the SMTP section and collect the logs and revert !

Hello Vivek,

some additional information until I have created and evaluated the logs:
The problem occurs with 18.5.2 and 19.0.1, so regardless of the firmware.
MTA is in use everywhere.

Best regards
Michael

And have you checked if your ISP is not blacklisted ? 
mxtoolbox.com/blacklists.aspx

Hello Vivek,

I checked the IP addresses of the sending email servers. None of them were blacklisted.
Again for clarity:
Customer-Email->via SMTP->Our Firewall (MTA)->Our Exchange Server.
And we have three tenants, each with a policy in which the RBLs are entered.
And please don't forget that the problem was reported to several customers of ours, as some important emails went through sometimes and sometimes not.
The complaints went away immediately when I removed the RBLs, and I didn't see any more blocks in the SMTP log.

Overall, this is getting a bit annoying as customers are now complaining that so much crap is ending up in quarantine. And there is no preview at this point either (as I learned that this is only available with the UTM). All in all, it's a pity, since customers pay for the SMTP module. And switching customers to SOPHOS Central Email is not really an option at the moment.

Best regards
Michael

Would request you to raise a sophos support request and get this further investigated !!

Please give me some more time, I have just re-integrated the RBLs and am running the log as you described.

Yes, of course I checked whether the blocked addresses were on a block list - which they were not.

I find it interesting that the same email senders sometimes went through and sometimes were blocked.

If that was due to the RBLs, then the whole world would have a problem with it.

Best regards
Michael

Please give me some more time, I have just re-integrated the RBLs and am running the log as you described.

Yes, of course I checked whether the blocked addresses were on a block list - which they were not.

I find it interesting that the same email senders sometimes went through and sometimes were blocked.

If that was due to the RBLs, then the whole world would have a problem with it.

Best regards
Michael