Inbound Email FAQContents Instance is not receiving email I send to it.My instance is receiving email successfully. However, the Inbound Email Action is not triggered or it takes a long time to process. How do I troubleshoot?Instance received inbound email with malicious attachment. The attachment went through the Inbound Action and was attached to the target record. How do we prevent this?We just received what seems to be a phishing attempt email or SPAM. How do we stop the instance from processing these messages?Inbound email is being ignored. Why?When sending email to the instance, it is bounced back for being too large, sometimes even though the email size as seen in your mail client or operating system appears to be under the mail server's documented limit. Is it possible to increase this limit? If yes, what size limit would you recommend?When sending email with an attachment to the instance. The attachment was not added to the target record even when the attachment size is well below the maximum.Why inbound emails are classified as new when these are reply emails?Inbound Emails with Attachment icons / Logos / Signatures Images Adds Duplicate Attachments and Repeats in Target Record's Activity Notes. How do I stop these images from being added to case?I would like to create records on multiple tables based on the inbound email. For example, if the subject contains "create problem", then the inbound action creates a record in the problem table. However, if the subject contains "create case", then the inbound action creates a record in the case table. User's forwarded emails sent to the instance are being treated as new email and creating new records. I expect (or I want) these records to be treated as replies since they have a watermark or a record number. Can I configure my instance to treat forward emails as replies?How much email messages can my instance receive at one time? How much time should I expect from the time a user sends an email to the instance to the time the instance receives it? 1. Instance is not receiving email I send to it. This is the best set of instructions to troubleshoot these types of issues: KB0520595 - Troubleshooting Inbound Email 2. My instance is receiving email successfully. However, the Inbound Email Action is not triggered or it takes a long time to process. How do I troubleshoot? There are two main reasons for inbound email not getting processed or taking a long time to process. Issues with events and/or event processing and Inbound Email Action misconfiguration. Events Inbound Actions depend on the platform's events and event processor component. If the Event Processor is not running or there are so many events that the Event Processor cannot keep up with the demand, then Inbound Actions will be affected. Some of the issues that can cause the events to not process or process late include: Emails subjects stating unwanted or unidentifiable headers such as postmaster@ can generate a lot of emails that can cause the queue to be overloaded.The event processor might get overloaded due to 500+ events getting processed.If there are active transactions being worked on at the moment, that are taking way too long to process, then this can happen. for more info refer to KB0855277 - Inbound email processing is stuck alerts Inbound Email Actions Some of the more common Inbound Email Actions misconfigurations include: Conditions are not metIncorrect target tableIncorrect inbound action typeAnother inbound actions took priority for more info refer to: KB0538137 - Troubleshooting inbound email action issues 3. Instance received inbound email with malicious attachment. The attachment went through the Inbound Action and was attached to the target record. How do we prevent this? Scanning of inbound emails is performed in the infrastructure before the email even reaches the instance see Email Spam Scoring and Filtering It is of course possible for an infected attachment to get past this if it is not detected by the AV signature. See Incoming emails with infected attachments are not marked as SPAM. In this article you get instructions on how to submit to the AV vendor in order to have a malicious attachment investigated. As an extra precaution, we recommend you configure your email properties to only accept email from trusted domains. This property can be set in the Inbound Mail Configuration page as seen here: Inbound mail configuration I would also recommend you install the Email Filters plugin. This will allow you a much greater degree of control in the email filters and you could easily block the sender of these emails here to prevent any further mails from being processed see Email Filters 4. We just received what seems to be a phishing attempt email or SPAM. How do we stop the instance from processing these messages? First, let's address customers using ServiceNow mail servers. Every message sent through ServiceNow email servers is assessed for the likelihood of being spam. Based on the scoring assessment, ServiceNow adds headers to each message that can be used for filtering within the customer instance using the Email Filters plugin. Within the Email Filters module, there is a SPAM Assassin filter or a Move spam to junk folder filter. Update the filter conditions in order to enable filtering on the spam headers. Either one or both of the following headers may appear in an email: X-ServiceNow-Spam-Flag:YES X-ServiceNow-Virus:INFECTED The filter condition should, therefore, include an OR condition for both of those headers. After an email is moved to the Junk mailbox, no inbound actions are run against the email. Note that if you are using your own mail server, the SPAM headers will not be present. Perhaps your mail server does add similar headers. We recommend you reach out to your email administrator to request this information. For more information about this method of email filtering, see Email Spam Scoring and Filtering For information on other email security hardening options, please see Email security (instance security hardening) 5. Inbound email is being ignored. Why? There are several reasons why an instance would mark an inbound email as "ignored". Here are a couple of reasons: The email was sent by another instance. For more information, see KB0551482 - ServiceNow instance ignores email sent by another instance (Recommendations) The system enforces the maximum body size as set by the glide.email.inbound.max_body_chars property. Message body size limit properties The Email Filter feature flagged it as SPAM or malicious. For more information, see KB0549426 - Email SPAM Scoring and Filtering 6. When sending email to the instance, it is bounced back for being too large, sometimes even though the email size as seen in your mail client or operating system appears to be under the mail server's documented limit. Is it possible to increase this limit? If yes, what size limit would you recommend? When encountering this limit, there is no workaround if using the ServiceNow email servers. You must either send smaller emails (fewer attachments, smaller email body, etc), or employ your own email infrastructure that supports larger emails. If using your own separate email infrastructure instead of ServiceNow's, the same limit issue can exist. However, the size limit values for inbound and outbound may be different, as well as the error code reported. Consult your system's email administrator if you encounter this error. For more information, see KB0521772 - Email server size limit prevents emails from being sent or received 7. When sending email with an attachment to the instance. The attachment was not added to the target record even when the attachment size is well below the maximum. If an inbound email contains one or more email attachments, the inbound email action adds the attachments to the first record the action produces. 8. Why inbound emails are classified as new when these are reply emails? The instance receives an inbound email which is a Reply to a previous email sent to the instance and which resulted in a record creation. The received email is classified as NEW even though it contains an in-reply-to header matching the messageID from the previous email received. For a detailed description why a reply may be treated as a new inbound email see KB0750129 - Why Inbound emails with in-reply-to headers are classified as NEW? 9. Inbound Emails with Attachment icons / Logos / Signatures Images Adds Duplicate Attachments and Repeats in Target Record's Activity Notes. How do I stop these images from being added to case? If using system property glide.email.inbound.image_sys_attachment.filter.action alone does not work, to filter images from emails and reduce duplicate image attachments to target records, then configure both of the following mentioned system properties: glide.email.inbound.image_sys_attachment.filter.minimum_bytes glide.email.inbound.image_sys_attachment.filter.action 10. I would like to create records on multiple tables based on the inbound email. For example, if the subject contains "create problem", then the inbound action creates a record in the problem table. However, if the subject contains "create case", then the inbound action creates a record in the case table. This feature is not supported in an out-of-the-box. Inbound Email Actions only work on one table at a time. You will have to create one Inbound Email Action per each of the types of tables you need to create. 11. User's forwarded emails sent to the instance are being treated as new email and creating new records. I expect (or I want) these records to be treated as replies since they have a watermark or a record number. Can I configure my instance to treat forward emails as replies? Yes. Follow the instructions in KB0779404 - Is it possible for Forwarded emails to be treated as a reply Email and look up an existing record? 12. How much email messages can my instance receive at one time? How much time should I expect from the time a user sends an email to the instance to the time the instance receives it? This KB article goes into detail: KB0952320 - ServiceNow Instance Email Delivery and Volume SLA