Troubleshooting
Problem
Emails Failing to Send from QRadar – SendAsDenied Error
Symptom
Emails configured to be sent from QRadar through email server were failing with the following error in the mail logs(/var/log/maillog):
Jan 31 13:12:44 siem_CONSOLE.local postfix/smtp[804981]: 004FF8092D6: to=<email.address@domain.com>,
relay=smtp.office365.com/52.98.57.1301:587, delay=4579, delays=4578/0.04/0.14/0.13, dsn=5.2.252,status=bounced (host smtp.office365.com[x.x.x.x] said: 554 5.2.252 SendAsDenied; admin@qradar.com not allowed to send as QRADAR@localhost. localdomain; STOREDRV. Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception.
The error logs indicated that admin@qradar.com was attempting to send emails using the identity of QRADAR@localhost.localdomain, which was not permitted.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
28 March 2025
UID
ibm17185192