thanks for the reply, correct they both have the same domain, but synchronization@mydomain.com is not an email we have it was a fake email that was sent from cloudgate.m1net.com.sg what i did was a reboot and now i saw that it was getting blocked, it seems that the rules were getting blocked