Inbound email processing stuck after high-volume automated notifications flood the ServiceNow mailboxIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Inbound email processing slows significantly or stops when a large volume of automated notification emails arrives in the ServiceNow mailbox in a short period. The sys_email table grows rapidly, the inbound email queue backs up, and legitimate emails are delayed or not processed. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Inbound email processing is delayed or appears stuckA monitoring alert is triggered for inbound email processing being stuckThe sys_email table contains a very large number of unprocessed received emails — potentially tens of thousands — from a single sender or with a single subjectUnprocessed email count continues to grow over timeLegitimate inbound emails are delayed while the backlog is being processedEmail Reader job shows state of Running for an extended period Facts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Inbound email account uses the ServiceNow-managed POP3 mailboxHigh-volume emails originate from an automated external system (in this case, an AWS Simple Notification Service (SNS) misconfiguration, though the same scenario applies to any automated sender)The Email Reader job pulls all received emails into the instance and creates a sys_email record for each one — it cannot selectively ignore or delete emails before they are pulled inThe Events Processor job (not the Email Reader) is responsible for processing the email.read event against inbound email actions; a large backlog of email.read events overloads this processor and stalls normal email handlingAn email subject filter or sender filter can prevent emails from being processed by inbound email actions, but does not prevent records from being created in the sys_email tableConfirmed on Yokohama Patch 12 Hot Fix 1; may occur on other releases Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All currently supported releases Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When an external system sends a very large number of automated emails to the ServiceNow mailbox in a short period, the Email Reader job pulls all of them into the instance and generates a corresponding email.read event for each one. The Events Processor becomes overwhelmed by the volume of events, causing the inbound email queue to grow faster than it can be drained. Legitimate emails sit behind the backlog and are not processed until the queue clears. The root cause of the flood is always external to ServiceNow — a misconfigured notification rule, an automated alerting system, or a looping sender — and must be corrected at the source. Within ServiceNow, the impact can be mitigated by configuring an email filter to prevent the unwanted emails from triggering inbound email actions while the backlog clears. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1 — Identify the source of the high-volume emails In your ServiceNow instance, navigate to System Mailboxes > All > Received (https://<instance-name>/nav_to.do?uri=sys_email_list.do?sysparm_query=mailbox%3Dreceived).Sort by Created (descending) and look for a sender address or subject line that appears repeatedly across a large number of records. Note the sender address and subject.Contact the team responsible for the external system sending these emails and confirm whether the sends are intentional. If they are not, have the external team disable the notification at the source immediately. Note: Disabling the notification at the source stops new emails from being sent, but emails that are already in the mailbox queue continue to be pulled into the instance by the Email Reader job. There may be a delay of up to an hour before the queue clears. Step 2 — Configure an email filter to prevent the emails from processing Navigate to System Properties > Email (https://<instance-name>/nav_to.do?uri=sys_properties.do?sysparm_title=Email+Properties) and locate the Ignore emails with subject containing field, or navigate directly to the email filters list at System Mailboxes > Administration > Email Filters (https://<instance-name>/nav_to.do?uri=sys_email_filter_list.do).To add a subject-based ignore rule via Email Properties: Open System Properties > Email.In the Ignore emails with subject containing field, add the subject line of the unwanted emails (for example, Amazon S3 Notification).Click Save. To add a sender-based filter via Email Filters: Click New to create a new email filter record.Set Type to Received.In the From field, enter the sender address to ignore (for example, no-reply@sns.amazonaws.com).Set Action to Ignore.Click Submit. Note: Once a filter is in place, newly received emails matching the rule are marked as received-ignored and are not processed by any inbound email action. Records are still created in the sys_email table — the filter prevents processing, not ingestion. Emails already in the queue at the time the filter is applied are also marked as received-ignored as the Events Processor works through the backlog; this may take time depending on queue size.For guidance on configuring email address filters, see How to use email address filters to ignore any email from any sender — KB0869547. Step 3 — Monitor recovery Navigate to System Mailboxes > All > Received and filter by the sender address or subject to confirm that new emails matching the rule are now showing a state of Received-Ignored.Monitor the unprocessed email count in the sys_email table. Once the backlog clears, confirm that legitimate emails are processing normally.Once all unwanted emails have been marked as received-ignored and the queue has drained, you may remove or disable the filter if the external issue has been resolved and the emails are no longer arriving. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } How to use email address filters to ignore any email from any sender — KB0869547Inbound email processing is stuck alerts — KB0855277Inbound email actions — ServiceNow Product Documentation (latest)