To provide a more definitive answer, a snippet of the mail_logs containing the ICID and MID from this sending domain would be helpful.
The short answer, is that more than likely the incoming connection did not match the sendergroup/mail flow policy that you expected. A copy of the ICID and MID would give us a better picture.
To answer your question "does it take the most restrictive setting and apply it?", the answer is No, it doesn't take the most restrictive. In that Mail Policy > HAT Overview section, there are two basic columns that determine how inbound connections should be treated initially: Sender Group and Mail flow policy.
Think of the HAT Overview as the front door to your ESA appliance. If the inbound connection comes from a host that is on your whitelist or has a SBRS score of 7+, then they'll be put in the Whitelist sendergroup(SG) and given the royal treatment(e.g. Trusted mail flow policy, where there is less or no restrictions/limits). Now, if the SBRS score if -7 of an inbound connection, they'll be put into whatever SG bucket you have set up, let's say this is Suspectlist SG. The -7 SBRS connection will be put in the Suspectlist SG and be applied the Throttled mail flow policy, which has rate limiting and may have a size restriction.
My point is the "Mail flow policy" may determine size limits, but this limit is only applied after the connection has been assigned a Sendergroup. Once they've been assigned a sendergroup, then the mail flow policy is applied and with it, whatever message size limit that mail flow policy has.
Let me know if you have any questions.
I have my Accepted Policy under Mail Flow Policies set to allow 15MB files, but under the Blocked Policy, it's defaulted to 10MB. Does this mean that if a message comes in over the 10MB limit, it will be blocked? Does it take the most restrictive setting and apply it? I have a user that is trying to receive a file and the sender keeps getting a non delivery message saying they have exceeded the size limitation. The send swears it's under 15MB. Also, if a message does come in over the size limit, does it store the message somewhere or just block it where it never enters the appliance?
