If an inbound message has been denied based on the dnsbl plugin you may have only the connecting IP in the log file (no sender email, no recipient email).
When I find myself in this situation, I ask the email 'sender' to send an email to an account on the SME server and CC an account on another mail service (preferably not using a SME server). A temporary email at
mailinator.com can be used if you don't have a backup email address already.
When the copy arrives in the non-SME mailbox, look at the message source and identify the IP addresses that the message traversed. If for some reason I can't work with the email sender I use "nslookup -type=MX..." to try to figure out the IP addresses that might have been used by the sending organization. Or, if the IT guys at the sending org are knowledgeable and accessible, I ask them what IP address I should be looking for.
Now search /var/log/qpsmtpd/current or /var/log/qpsmtpd/* by IP address.
On a busy SME server, the default log settings for qpsmtpd may result in logs that cover as little as 12 hours of activity -- check the times and dates on the files in /var/log/qpsmtpd to see what time span your logs cover -- there's no point in searching for missing emails from a week ago if the logs only cover a day or two (and, if the logs only cover a day or two then "current" only covers 10% of that - 2 - 5 hours).
You can browse all of the 'denied' messages in your logs using:
grep -h logters.*\(deny /var/log/qpsmtpd/* |tai64nlocal |less -S
7 Replies
979 Views