Papa Labs

The afternoon all inbound email vanished: two hours stuck at the gateway's 'Accepted' state

2 min read #sophos#email#m365#saas#incident 中文

From 2 p.m., the whole company stopped receiving external email. Senders got no bounces (so the mail was being “taken”), yet M365 mailboxes stayed empty.

Locating the hop

Our inbound path: external → Sophos cloud email gateway (filtering) → M365. The gateway’s message logs answered instantly:

Timeline: mail stuck at Accepted for two hours, phone escalation, recovery, then the RCA demand

The two-hour incident in one view: stuck, escalated, recovered, held to account

Every inbound message between 14:00–16:00 sat in Accepted state — the gateway had taken the mail and then neither delivered to M365 nor retried. Just… held it.

That state is highly informative: the problem isn’t our M365 (mail never got there), isn’t DNS/MX (external delivery succeeded) — it’s the gateway’s own delivery queue.

You can’t fix SaaS — but you can do these four things

  1. Phone, don’t just ticket. The hotline’s answer: development and technical teams already on it — and the official status page had nothing posted yet. Which confirms an important truth: status pages trail real outages; never build your monitoring on them;
  2. Tell the business: “external mail is delayed, not lost” — cuts duplicate reports and panic;
  3. Preserve evidence: screenshots of the message log full of Accepted rows with timestamps — raw material for the post-incident accounting;
  4. Demand a written RFO/RCA after recovery. Our email spelled out three requirements:
  • Root Cause: a technical explanation of why inbound mail was stuck in “Accepted” and failing to return to our M365 tenant;
  • Timeline: exact start and end of the degradation;
  • Remediation: the steps taken to clear the queue and restore mailflow.

Plus one sentence — “I need to present this explanation to our management team” — which does wonders for a vendor’s prioritization.

Around 16:00 the queue drained and the backlog delivered. Nothing lost.

Lessons

  1. The email gateway is a single point of failure: when it stalls, the entire company’s inbound mail sits in its belly. Accept that when adopting cloud filtering — and bookmark the gateway’s message-log page now;
  2. “Accepted but not delivered” is a precise diagnostic state — learn your gateway’s message state machine and you can fix the responsibility boundary within five minutes of an incident;
  3. SaaS incident response = communication skills: escalation, internal notice, evidence, RCA collection. The RCA isn’t bureaucracy — it’s the only hard input for deciding whether this vendor keeps your mail flow.
← All posts