Why are we not getting any Alert Emails when we use the "Team" email address and only works on user email addresses?

[DDewarSplunk]

Afternoon

I work in a firm monitoring Splunk alerts etc.
We get various alerts sent to us from Splunk, and they all have a single "User" (e.g. JohnDoe@ABC.com) address in the "To" or "CC" field.

When we replace the user address with the "Team" email address (e.g. SplunkTeam@ABC.com) we get no emails.
When we add our own names in we get the emails alerts again.

The "Team" address is widely used to email our Team internally and externally, so we don't know why Splunk does not like it.
Can you advise if there is a Conf file we need to amend to get the Team \ Group email address to work ?

Thanks

David

[DDewarSplunk]

Thanks Bjoernhansen

I've logged a call to our Ops Team to check Exchange logs, wanted to rule our Splunk first.

Many Thanks

D

[nfudenberg]

Did this end up being internal? Or is this a case of Splunk blacklisting your team email address?

If it is the latter how did you go about stopping them from continually re-blacklisting it?

[DDewarSplunk]

Internal, I checked the various email addresses and they had been locked down by our internal access team

[bjoernhansen · Accepted solution]

Hey,
to Splunk, these email addresses are all the same.
It can't even know if there is some kind of distribution or shared mailbox behind the address - so this is 99% sure not a Splunk issue.
I'd take a look in the splunkd.log to see if there are any errors related to mail sending thrown by whatever mail server is being used to deliver the mails.
If not, I would ask my mail server admin to take a look in the mail server log at the time a mail is supposed to be sent, to check if anything pops up there.