Wondered if anyone had seen behaviour like this before. 2 appliances in a centralised management deployment.
one listener only on each box with each listner having a relay hat policy and a default incoming policy. We are seeing outbound connections hit ironport 1 from exchange and are seeing instances of this error
Info: ICID xx Receiving failed: Too many messages.
At the same time it looks like messages are reported in the incoming report view (as opposed to outgoing) and also reported as being stopped by reputation filtering??? Under the incoming mail view the sender can be seen to be the IP address of the exchange.
The exchange box is definately specified in the relay hat group and it has an associated "relay" mail flow policy where obviously no SBRS checking is taking place.
Any ideas on what could be causing them to be reported as incoming?