Topic: help: undelivered email

[ltwally]

We are not receiving email from another company, and I am very curious as to why not.

Before I post the log, I will mention that I have checked the other company on mxtoolbox.com and they were fine in both their config and blacklist status.

If I'm reading this log correctly, SME is flagging the incoming mail as spam for various reasons.  However, there is nothing in the recipient's junkmail folder... so SME is just sending it to a blackhole, yes?

Anyone out there with more experience with these logs -  your attention is appreciated.

Here is a (obfuscated) copy of the qpsmtpd log from that company.  I'm thinking timestamp 819814500 is the where it's getting snagged...?

Code: [Select]

2009-04-16 11:18:06.488827500 4158 Accepted connection 0/40 from 74.202.xxx.xxx / 74-202-xxx-xxx.static.twtelecom.net
2009-04-16 11:18:06.489045500 4158 Connection from 74-202-xxx-xxx.static.twtelecom.net [74.202.xxx.xxx]
2009-04-16 11:18:07.504157500 4158 check_earlytalker plugin: remote host said nothing spontaneous, proceeding
2009-04-16 11:18:07.513440500 4158 220 SERVER.OURDOMAIN.com ESMTP
2009-04-16 11:18:07.565152500 4158 dispatching EHLO mail.THEIRDOMAIN.com
2009-04-16 11:18:07.566351500 4158 250-OURDOMAIN.com Hi 74-202-xxx-xxx.static.twtelecom.net [74.202.xxx.xxx]
2009-04-16 11:18:07.566352500 4158 250-PIPELINING
2009-04-16 11:18:07.566353500 4158 250-8BITMIME
2009-04-16 11:18:07.566359500 4158 250-SIZE 100000000
2009-04-16 11:18:07.566360500 4158 250 AUTH PLAIN LOGIN
2009-04-16 11:18:07.621153500 4158 dispatching MAIL FROM:<wes@THEIRDOMAIN.com> SIZE=292748
2009-04-16 11:18:07.621155500 4158 full from_parameter: FROM:<wes@THEIRDOMAIN.com> SIZE=292748
2009-04-16 11:18:07.621156500 4158 from email address : [<wes@THEIRDOMAIN.com>]
2009-04-16 11:18:07.628690500 4158 getting mail from <wes@THEIRDOMAIN.com>
2009-04-16 11:18:07.628863500 4158 250 <wes@THEIRDOMAIN.com>, sender OK - how exciting to get mail from you!
2009-04-16 11:18:07.685067500 4158 dispatching RCPT TO:<garyc@OURDOMAIN.com>
2009-04-16 11:18:07.685069500 4158 to email address : [<garyc@OURDOMAIN.com>]
2009-04-16 11:18:16.179974500 4158 check_goodrcptto plugin: stripping '-' extensions
2009-04-16 11:18:16.184062500 4158 250 <garyc@OURDOMAIN.com>, recipient ok
2009-04-16 11:18:16.230968500 4158 dispatching DATA
2009-04-16 11:18:16.230970500 4158 354 go ahead
2009-04-16 11:18:16.301191500 4158 spooling message to disk
2009-04-16 11:18:24.819814500 4158 spamassassin plugin: check_spam: Yes, hits=9.0, required=5.0, tests=HTML_IMAGE_ONLY_28,HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,SARE_GIF_ATTACH,TVD_RCVD_IP
2009-04-16 11:18:24.819817500 4158 virus::clamav plugin: Changing permissions on file to permit scanner access
2009-04-16 11:18:24.966971500 4158 virus::clamav plugin: clamscan results: /var/spool/qpsmtpd/1239905896:4158:0: OK
2009-04-16 11:18:24.966973500 4158 logging::logterse plugin: ` 74.202.xxx.xxx 74-202-xxx-xxx.static.twtelecom.net mail.THEIRDOMAIN.com <wes@THEIRDOMAIN.com> <garyc@OURDOMAIN.com> queued <C60CC46C.98F%wes@THEIRDOMAIN.com> Yes, hits=9.0 required=5.0_
2009-04-16 11:18:24.966975500 4180 queue::qmail_2dqueue plugin: (for 4158 ) Queuing qp 4180 to /var/qmail/bin/qmail-queue
2009-04-16 11:18:25.010559500 4158 250 Queued! 1239905905 qp 4180 <C60CC46C.98F%wes@THEIRDOMAIN.com>
2009-04-16 11:18:25.061791500 4158 dispatching QUIT
2009-04-16 11:18:25.061793500 4158 221 OURDOMAIN.com closing connection. Have a wonderful day.
2009-04-16 11:18:25.061794500 4158 click, disconnecting
2009-04-16 11:18:25.473160500 3963 cleaning up after 4158
Thanks in advance.

[CharlieBrady]

We are not receiving email from another company, ...

You are receiving it. Check the qmail log for delivery status - I would guess it's being redirected to garyc's junkmail folder - via the address garyc-junkmail.

[ltwally]

It isn't there, either, though.

Believe me, we checked.

[stephen noble]

check_spam: Yes, hits=9.0, required=5.0

is spamassassin reject level <= 9

[CharlieBrady]

is spamassassin reject level <= 9

The message would have been rejected, and not queued via qmail-queue if that were the case.

[ltwally]

Sorry for the lateness of my reply; I have been on vacation.

At any rate, the spamassassin reject level is 12.

Code: [Select]

[root@OURSERVER ~]# config show spamassassin
spamassassin=service
    DNSAvailable=yes
    MessageRetentionTime=90
    OkLanguages=all
    OkLocales=all
    RejectLevel=12
    ReportSafe=0
    Sensitivity=medium
    SkipRBLChecks=0
    SortSpam=enabled
    Subject=[SPAM]
    SubjectTag=enabled
    TagLevel=4
    UseBayes=0
    status=enabled
Any other ideas?

Thanks!

[piran]

Any other ideas?

Perhaps garyc is over quota?

[ltwally]

Perhaps garyc is over quota?

Nope.  He is well under quota, and is receiving mail from everyone else just fine.

[piran]

Any other ideas?

ClamAV quarantine enabled?

[CharlieBrady]

I don't see any references to what you have found in the qmail logs.

[jokiin]

Any other ideas?

done any updates recently and NOT done the signal-event post-upgrade and signal-event reboot afterward?

[ltwally]

done any updates recently and NOT done the signal-event post-upgrade and signal-event reboot afterward?

I have not.  I'll double check and make sure that our owner has not, either.

[ltwally]

I don't see any references to what you have found in the qmail logs.

Apologies.  I am somewhat uncertain which logs are relevant....

Here is a (obfuscated) copy of the relevant section:

Code: [Select]

2009-04-16 11:18:25.009447500 new msg 13519445
2009-04-16 11:18:25.009449500 info msg 13519445: bytes 289205 from <wes@THEIRDOMAIN.com> qp 4180 uid 453
2009-04-16 11:18:25.013343500 starting delivery 1236: msg 13519445 to local alias-localdelivery-garyc@OURDOMAIN.com
2009-04-16 11:18:25.013344500 status: local 1/10 remote 0/20
2009-04-16 11:18:25.075588500 new msg 13518113
2009-04-16 11:18:25.075590500 info msg 13518113: bytes 289329 from <wes@THEIRDOMAIN.com> qp 4183 uid 400
2009-04-16 11:18:25.078499500 starting delivery 1237: msg 13518113 to local garyc@SERVER.OURDOMAIN.com
2009-04-16 11:18:25.078500500 status: local 2/10 remote 0/20
2009-04-16 11:18:25.078501500 delivery 1236: success: forward:_qp_4183/did_0+0+1/
2009-04-16 11:18:25.078503500 status: local 1/10 remote 0/20
2009-04-16 11:18:25.078503500 end msg 13519445
2009-04-16 11:18:25.087571500 new msg 13519445
2009-04-16 11:18:25.087573500 info msg 13519445: bytes 289443 from <wes@THEIRDOMAIN.com> qp 4187 uid 5008
2009-04-16 11:18:25.090493500 starting delivery 1238: msg 13519445 to local alias-localdelivery-garyc-junkmail@OURDOMAIN.com
2009-04-16 11:18:25.090494500 status: local 2/10 remote 0/20
2009-04-16 11:18:25.090496500 delivery 1237: success: condredirect:_qp_4187/did_0+0+1/
2009-04-16 11:18:25.090497500 status: local 1/10 remote 0/20
2009-04-16 11:18:25.090498500 end msg 13518113
2009-04-16 11:18:25.098668500 new msg 13518113
2009-04-16 11:18:25.098670500 info msg 13518113: bytes 289575 from <wes@THEIRDOMAIN.com> qp 4190 uid 400
2009-04-16 11:18:25.101495500 starting delivery 1239: msg 13518113 to local garyc-junkmail@SERVER.OURDOMAIN.com
2009-04-16 11:18:25.101497500 status: local 2/10 remote 0/20
2009-04-16 11:18:25.101498500 delivery 1238: success: forward:_qp_4190/did_0+0+1/
2009-04-16 11:18:25.101499500 status: local 1/10 remote 0/20
2009-04-16 11:18:25.101500500 end msg 13519445
2009-04-16 11:18:25.115801500 delivery 1239: success: did_1+0+1/
2009-04-16 11:18:25.115803500 status: local 0/10 remote 0/20
2009-04-16 11:18:25.115804500 end msg 13518113
It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!

[jokiin]

It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!

are you checking the junkmail folder on the server itself, not in his local email client?

[CharlieBrady]

Apologies.  I am somewhat uncertain which logs are relevant....

2009-04-16 11:18:25.101498500 delivery 1238: success: forward:_qp_4190/did_0+0+1/

...

It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!

What does:

cat ~wes/.qmail-junkmail

show you? The log suggests that it is forwarding the message somewhere.