Docs / Obsidian Suite / Reference
Troubleshooting and FAQ
Symptoms, causes and fixes for the problems you are most likely to meet. If none of this helps, contact us with the message's X-Obsidian-ID or a Message trace link.
Mail is not arriving
- Is it reaching Obsidian Suite? Search Message trace for the sender. Nothing there? Check that the domain's MX record points at
mx1.obsidiansuite.net(the domain page shows the current MX). Senders on the Spamhaus ZEN blocklist are turned away before a message exists, so they never appear in the trace. - In the trace as delivered, but not in the mailbox? Run Test delivery host on the domain page. For Microsoft 365, check that the inbound connector's IP restriction includes every Obsidian Suite address shown on the domain page; for Exchange, check the receive connector.
- Held for AI? In Quarantine, set Status to Held for AI. Held mail is normally decided within a minute or two; you can release a message yourself at any time.
Senders get "451 ... try again later"
Obsidian Suite asks the sending server to retry when a message cannot be scanned completely right now, rather than deliver it unscanned. Sending servers retry automatically, so the message arrives a little later. If it keeps happening, contact us.
Legitimate mail is quarantined
- Open the message and read Why. Authentication failures (
SPF_FAIL,DMARC_FAIL_*) are the most common cause: the sender's DNS is wrong. Tell them; meanwhile allow-list the sender or domain. - Release it and click Not spam, so the Bayesian filter learns.
- If a whole category is too strict, adjust the policy thresholds with an override.
Your own servers' mail is quarantined as a spoof
Applications, scanners or web servers that send mail as your domain without SPF or DKIM are flagged SPOOF_INTERNAL_DOMAIN with authentication failures. Send their mail through your mail platform, or add their address to your domain's SPF record. If they must send straight to Obsidian Suite, contact us.
Spam is getting through
- Open it in Message trace (search the subject) and look at its score and rules.
- Report spam: once there are 50 reports of each kind, the Bayesian filter starts contributing. See Learning.
- Block the sender or domain if it is a persistent source.
- Lower the quarantine threshold with a policy override.
Outbound mail is refused with "Relaying denied"
- Allow outbound relay is off for the domain, or your sending servers are not yet allowed to relay: contact us.
- The domain has a relay key and the message did not carry the correct
X-Obsidian-Relay-Keyheader. Check that your platform's rule has the current key. See Sending outbound mail.
Users cannot release a message
It is admin-only (virus, malware or phishing), or its verdict is not in the policy's Users may release their own list. An administrator can release it from the console if it is safe.
Digest links say "expired" or do nothing
Digest links last 7 days, and each one opens a confirmation page where the button must be clicked. If digests do not arrive at all, check that Send quarantine digests is ticked on the user (or Email me a summary when mail is quarantined in their portal), and look in the Junk folder.
Sign-in problems
| Problem | Fix |
|---|---|
| "Account temporarily locked after repeated failures" | Wait a few minutes, or have an administrator save the user's record, which unlocks it. |
| Lost two-factor device | An administrator ticks Reset two-factor on the user. |
| "is not a protected mailbox" after signing in with Microsoft or Google | The account is not a user in Obsidian Suite yet. Run Sync users on the API connector. |
| "That sign-in link is invalid or has expired" | Sign-in links last 15 minutes. Ask for a new one. |
| "Security token expired" | The page was open too long. Reload it and try again. |
Connector errors
See API connectors.
Frequently asked
Do we need to install anything?
No. Larström Technologies runs the whole service. You change settings on your mail platform and your DNS records.
Where is our mail processed?
In the United States, on servers Larström Technologies owns and operates. Quarantined mail stays there until it is released, deleted or its retention period ends.
Does the AI send our mail to OpenAI or another AI provider?
No. The AI model runs on Larström Technologies' own servers. Message content is never sent to an outside AI provider.
What if a check fails?
Mail is never lost. If one check fails, it is marked as errored and the others still decide. If the virus scanner is unavailable, the sending server is asked to try again later. If the AI model is unreachable for longer than the policy's maximum hold, the rules decide.
Which mail platforms are supported?
Microsoft 365, Google Workspace and Exchange Server, alone or mixed. Any mail server that receives mail over SMTP works in gateway mode.
Can we route outbound mail through Obsidian Suite?
Yes. See Sending outbound mail.