Incoming emails with signatures/tables/inline images rejected with “Access Denied”

I am seeing incoming emails rejected by Discourse with:

Email can not be processed: Access Denied

Incoming email itself appears to be working correctly. The message reaches the mail receiver, and SPF, DKIM and DMARC all pass. Discourse then processes it through Jobs::ProcessEmail.

The behaviour appears dependent on the MIME/body content:

  • simple/plain email → accepted
  • email containing an Outlook signature, table and/or inline images → rejected with Access Denied

The rejected email log shows the failure occurring in Email::Processor#process!.

Discourse application version:

4143157a17dc3ff63c909c64d0cf578243d38861

This installation was recently migrated/restored to another server, but incoming SMTP delivery itself is functioning and the behaviour seems specifically related to richer email bodies.

I can provide a sanitised raw MIME message and further IncomingEmail/Email::Receiver diagnostics if useful.