Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=email-history-rejected-report

Rejected report

The Rejected report, also known as "rejection log report", shows messages that were rejected because the mailbox wasn't found in Sophos Email.

Warning

If we detect more than 1,000 messages from a single IP address within a five-minute window, we temporarily stop logging more messages from that IP address and send an alert. You can see the alert from the Alerts page.

After five minutes, we'll resume normal logging of rejection messages.

Table

For each rejected message, the report shows the following details:

  • Date: The date and time of the most recent activity for the message.
  • Sender: The sender's email address.
  • Sender IP: The sender's IP address.
  • Recipient: The recipient's email address.
  • Type: The type of message, either "Gateway" or "Mailflow".
  • Reason: The reason why the message was rejected, such as a mailbox not being found.

Note

Rejected messages can't be released from Sophos Email. If a message is rejected due to a hard bounce reason, such as a "Mailbox couldn't be found" or a "550 5.1.1 User unknown" error, it isn't quarantined or retained by Sophos. Therefore, you can't resent rejected messages.

Filter messages

You can filter the Rejected report by Rejection Reason using the drop-down menu above the report table. The available options are as follows:

  • All: Shows all rejected messages.
  • Mailbox not found: Shows only rejected messages due to a missing mailbox.

  • TLS failure: Shows only rejected messages due to a failed TLS handshake.

    • Version mismatched: Shows only rejected messages where the TLS version didn't meet the expected requirement.

      Tip

      You can select Version mismatched as the reason. Hover over the value in the Reason column to see details about the mismatch.

      Hover over the value in the "Reason" column.

    • Unencrypted: Shows only rejected messages that weren't sent over TLS.

After you've selected a rejection reason, click the Refresh icon Refresh icon. to update the report.

In Message History, you can use Advanced Search to filter and find specific messages.

Click Advanced Search to begin.

You can filter messages by the following search fields:

  • From: Sender. Supports partial strings. Not case sensitive.
  • To: Recipient. Supports partial strings. Not case sensitive.
  • Sender Ip: The sender's IP address. Supports partial IP address value.

You can configure several search criteria. The search results will include messages that match all criteria.

You can also filter messages by Type or Rejection Reason.

If you change the date range or filter the messages, you must click the Refresh icon Refresh icon. to update the search results.

In your search results, the parameters you selected appear in the search box. You can click individual parameters to remove them from the search. Your search results are updated immediately.

You can click the direction arrow to limit your search to inbound or outbound messages. The down arrow is for inbound messages, and the up arrow is for outbound messages. If you click a direction arrow, your search results are updated immediately.

Schedule a report

You can schedule the Rejected report as a custom report. Save as Custom Report lets you save the Rejected report using the "Email Rejection Report" template on the Reports page.

Show me how

For more information on saving or scheduling reports, see Email reports.

Export a report

You can export a Rejected report that contains a record of activities for a selected date range of up to 30 days, or 90 days with a Sophos Email Plus license. The exported file contains all applied filters at the time of export.

Click Export as CSV to download the report as a CSV file.