Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: ltwally on April 17, 2009, 11:33:30 PM

Title: help: undelivered email
Post by: ltwally on April 17, 2009, 11:33:30 PM: We are not receiving email from another company, and I am very curious as to why not.

Before I post the log, I will mention that I have checked the other company on mxtoolbox.com and they were fine in both their config and blacklist status.

If I'm reading this log correctly, SME is flagging the incoming mail as spam for various reasons. However, there is nothing in the recipient's junkmail folder... so SME is just sending it to a blackhole, yes?

Anyone out there with more experience with these logs - your attention is appreciated.

Here is a (obfuscated) copy of the qpsmtpd log from that company. I'm thinking timestamp 819814500 is the where it's getting snagged...?
Code: [Select]
2009-04-16 11:18:06.488827500 4158 Accepted connection 0/40 from 74.202.xxx.xxx / 74-202-xxx-xxx.static.twtelecom.net 2009-04-16 11:18:06.489045500 4158 Connection from 74-202-xxx-xxx.static.twtelecom.net [74.202.xxx.xxx] 2009-04-16 11:18:07.504157500 4158 check_earlytalker plugin: remote host said nothing spontaneous, proceeding 2009-04-16 11:18:07.513440500 4158 220 SERVER.OURDOMAIN.com ESMTP 2009-04-16 11:18:07.565152500 4158 dispatching EHLO mail.THEIRDOMAIN.com 2009-04-16 11:18:07.566351500 4158 250-OURDOMAIN.com Hi 74-202-xxx-xxx.static.twtelecom.net [74.202.xxx.xxx] 2009-04-16 11:18:07.566352500 4158 250-PIPELINING 2009-04-16 11:18:07.566353500 4158 250-8BITMIME 2009-04-16 11:18:07.566359500 4158 250-SIZE 100000000 2009-04-16 11:18:07.566360500 4158 250 AUTH PLAIN LOGIN 2009-04-16 11:18:07.621153500 4158 dispatching MAIL FROM:<wes@THEIRDOMAIN.com> SIZE=292748 2009-04-16 11:18:07.621155500 4158 full from_parameter: FROM:<wes@THEIRDOMAIN.com> SIZE=292748 2009-04-16 11:18:07.621156500 4158 from email address : [<wes@THEIRDOMAIN.com>] 2009-04-16 11:18:07.628690500 4158 getting mail from <wes@THEIRDOMAIN.com> 2009-04-16 11:18:07.628863500 4158 250 <wes@THEIRDOMAIN.com>, sender OK - how exciting to get mail from you! 2009-04-16 11:18:07.685067500 4158 dispatching RCPT TO:<garyc@OURDOMAIN.com> 2009-04-16 11:18:07.685069500 4158 to email address : [<garyc@OURDOMAIN.com>] 2009-04-16 11:18:16.179974500 4158 check_goodrcptto plugin: stripping '-' extensions 2009-04-16 11:18:16.184062500 4158 250 <garyc@OURDOMAIN.com>, recipient ok 2009-04-16 11:18:16.230968500 4158 dispatching DATA 2009-04-16 11:18:16.230970500 4158 354 go ahead 2009-04-16 11:18:16.301191500 4158 spooling message to disk 2009-04-16 11:18:24.819814500 4158 spamassassin plugin: check_spam: Yes, hits=9.0, required=5.0, tests=HTML_IMAGE_ONLY_28,HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,SARE_GIF_ATTACH,TVD_RCVD_IP 2009-04-16 11:18:24.819817500 4158 virus::clamav plugin: Changing permissions on file to permit scanner access 2009-04-16 11:18:24.966971500 4158 virus::clamav plugin: clamscan results: /var/spool/qpsmtpd/1239905896:4158:0: OK 2009-04-16 11:18:24.966973500 4158 logging::logterse plugin: ` 74.202.xxx.xxx 74-202-xxx-xxx.static.twtelecom.net mail.THEIRDOMAIN.com <wes@THEIRDOMAIN.com> <garyc@OURDOMAIN.com> queued <C60CC46C.98F%wes@THEIRDOMAIN.com> Yes, hits=9.0 required=5.0_ 2009-04-16 11:18:24.966975500 4180 queue::qmail_2dqueue plugin: (for 4158 ) Queuing qp 4180 to /var/qmail/bin/qmail-queue 2009-04-16 11:18:25.010559500 4158 250 Queued! 1239905905 qp 4180 <C60CC46C.98F%wes@THEIRDOMAIN.com> 2009-04-16 11:18:25.061791500 4158 dispatching QUIT 2009-04-16 11:18:25.061793500 4158 221 OURDOMAIN.com closing connection. Have a wonderful day. 2009-04-16 11:18:25.061794500 4158 click, disconnecting 2009-04-16 11:18:25.473160500 3963 cleaning up after 4158
Thanks in advance.
Title: Re: help: undelivered email
Post by: CharlieBrady on April 18, 2009, 12:54:50 AM: Quote from: ltwally on April 17, 2009, 11:33:30 PM
We are not receiving email from another company, ...

You are receiving it. Check the qmail log for delivery status - I would guess it's being redirected to garyc's junkmail folder - via the address garyc-junkmail.
Title: Re: help: undelivered email
Post by: ltwally on April 18, 2009, 12:56:03 AM: It isn't there, either, though.

Believe me, we checked.
Title: Re: help: undelivered email
Post by: stephen noble on April 18, 2009, 02:31:02 AM: Quote
check_spam: Yes, hits=9.0, required=5.0
is spamassassin reject level <= 9
Title: Re: help: undelivered email
Post by: CharlieBrady on April 18, 2009, 03:57:47 PM: Quote from: snoble on April 18, 2009, 02:31:02 AM
is spamassassin reject level <= 9

The message would have been rejected, and not queued via qmail-queue if that were the case.
Title: Re: help: undelivered email
Post by: ltwally on April 26, 2009, 02:12:24 AM: Sorry for the lateness of my reply; I have been on vacation.

At any rate, the spamassassin reject level is 12.

Code: [Select]
[root@OURSERVER ~]# config show spamassassin spamassassin=service DNSAvailable=yes MessageRetentionTime=90 OkLanguages=all OkLocales=all RejectLevel=12 ReportSafe=0 Sensitivity=medium SkipRBLChecks=0 SortSpam=enabled Subject=[SPAM] SubjectTag=enabled TagLevel=4 UseBayes=0 status=enabled
Any other ideas?

Thanks!
Title: Re: help: undelivered email
Post by: piran on April 26, 2009, 04:28:19 PM: Quote from: ltwally on April 26, 2009, 02:12:24 AM
Any other ideas?
Perhaps garyc is over quota?
Title: Re: help: undelivered email
Post by: ltwally on April 26, 2009, 05:05:38 PM: Quote from: piran on April 26, 2009, 04:28:19 PM
Perhaps garyc is over quota?

Nope. He is well under quota, and is receiving mail from everyone else just fine.
Title: Re: help: undelivered email
Post by: piran on April 26, 2009, 05:12:05 PM: Quote from: ltwally on April 26, 2009, 02:12:24 AM
Any other ideas?
ClamAV quarantine enabled?
Title: Re: help: undelivered email
Post by: CharlieBrady on April 27, 2009, 01:55:11 AM: I don't see any references to what you have found in the qmail logs.
Title: Re: help: undelivered email
Post by: jokiin on April 27, 2009, 04:02:12 AM: Quote from: ltwally on April 26, 2009, 02:12:24 AM

Any other ideas?

done any updates recently and NOT done the signal-event post-upgrade and signal-event reboot afterward?
Title: Re: help: undelivered email
Post by: ltwally on April 27, 2009, 06:37:03 AM: Quote from: jokiin on April 27, 2009, 04:02:12 AM
done any updates recently and NOT done the signal-event post-upgrade and signal-event reboot afterward?

I have not. I'll double check and make sure that our owner has not, either.
Title: Re: help: undelivered email
Post by: ltwally on April 27, 2009, 07:01:52 AM: Quote from: CharlieBrady on April 27, 2009, 01:55:11 AM
I don't see any references to what you have found in the qmail logs.

Apologies. I am somewhat uncertain which logs are relevant....

Here is a (obfuscated) copy of the relevant section:
Code: [Select]
2009-04-16 11:18:25.009447500 new msg 13519445 2009-04-16 11:18:25.009449500 info msg 13519445: bytes 289205 from <wes@THEIRDOMAIN.com> qp 4180 uid 453 2009-04-16 11:18:25.013343500 starting delivery 1236: msg 13519445 to local alias-localdelivery-garyc@OURDOMAIN.com 2009-04-16 11:18:25.013344500 status: local 1/10 remote 0/20 2009-04-16 11:18:25.075588500 new msg 13518113 2009-04-16 11:18:25.075590500 info msg 13518113: bytes 289329 from <wes@THEIRDOMAIN.com> qp 4183 uid 400 2009-04-16 11:18:25.078499500 starting delivery 1237: msg 13518113 to local garyc@SERVER.OURDOMAIN.com 2009-04-16 11:18:25.078500500 status: local 2/10 remote 0/20 2009-04-16 11:18:25.078501500 delivery 1236: success: forward:_qp_4183/did_0+0+1/ 2009-04-16 11:18:25.078503500 status: local 1/10 remote 0/20 2009-04-16 11:18:25.078503500 end msg 13519445 2009-04-16 11:18:25.087571500 new msg 13519445 2009-04-16 11:18:25.087573500 info msg 13519445: bytes 289443 from <wes@THEIRDOMAIN.com> qp 4187 uid 5008 2009-04-16 11:18:25.090493500 starting delivery 1238: msg 13519445 to local alias-localdelivery-garyc-junkmail@OURDOMAIN.com 2009-04-16 11:18:25.090494500 status: local 2/10 remote 0/20 2009-04-16 11:18:25.090496500 delivery 1237: success: condredirect:_qp_4187/did_0+0+1/ 2009-04-16 11:18:25.090497500 status: local 1/10 remote 0/20 2009-04-16 11:18:25.090498500 end msg 13518113 2009-04-16 11:18:25.098668500 new msg 13518113 2009-04-16 11:18:25.098670500 info msg 13518113: bytes 289575 from <wes@THEIRDOMAIN.com> qp 4190 uid 400 2009-04-16 11:18:25.101495500 starting delivery 1239: msg 13518113 to local garyc-junkmail@SERVER.OURDOMAIN.com 2009-04-16 11:18:25.101497500 status: local 2/10 remote 0/20 2009-04-16 11:18:25.101498500 delivery 1238: success: forward:_qp_4190/did_0+0+1/ 2009-04-16 11:18:25.101499500 status: local 1/10 remote 0/20 2009-04-16 11:18:25.101500500 end msg 13519445 2009-04-16 11:18:25.115801500 delivery 1239: success: did_1+0+1/ 2009-04-16 11:18:25.115803500 status: local 0/10 remote 0/20 2009-04-16 11:18:25.115804500 end msg 13518113
It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!
Title: Re: help: undelivered email
Post by: jokiin on April 27, 2009, 10:52:07 AM: Quote from: ltwally on April 27, 2009, 07:01:52 AM

It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!

are you checking the junkmail folder on the server itself, not in his local email client?
Title: Re: help: undelivered email
Post by: CharlieBrady on April 27, 2009, 02:43:58 PM: Quote from: ltwally on April 27, 2009, 07:01:52 AM
Apologies. I am somewhat uncertain which logs are relevant....

2009-04-16 11:18:25.101498500 delivery 1238: success: forward:_qp_4190/did_0+0+1/

...

It seems to be indicating that it went to his junkmail folder, but I checked for myself - it is not there!

What does:

cat ~wes/.qmail-junkmail

show you? The log suggests that it is forwarding the message somewhere.
Title: Re: help: undelivered email
Post by: ltwally on April 27, 2009, 03:56:58 PM: Quote from: CharlieBrady on April 27, 2009, 02:43:58 PM
What does:

cat ~wes/.qmail-junkmail

show you? The log suggests that it is forwarding the message somewhere.

"wes" is the remote sender - not a local user.
Title: Re: help: undelivered email
Post by: CharlieBrady on April 28, 2009, 02:57:21 PM: Quote from: ltwally on April 27, 2009, 03:56:58 PM
"wes" is the remote sender - not a local user.

Sorry, what does:

cat ~garyc/.qmail-junkmail

tell you?
Title: Re: help: undelivered email
Post by: ltwally on April 28, 2009, 03:53:14 PM: Quote from: CharlieBrady on April 28, 2009, 02:57:21 PM
Sorry, what does:

cat ~garyc/.qmail-junkmail

tell you?

Code: [Select]
[root@SERVER ~]# cat ~garyc/.qmail-junkmail #------------------------------------------------------------ # !!DO NOT MODIFY THIS FILE!! # # Manual changes will be lost when this file is regenerated. # # Please read the developer's guide, which is available # at http://www.contribs.org/development/ # # Copyright (C) 1999-2006 Mitel Networks Corporation #------------------------------------------------------------ | [ -d ./Maildir/.junkmail/ ] || /var/qmail/bin/maildirmake ./Maildir/.junkmail/ ./Maildir/.junkmail/
Title: Re: help: undelivered email
Post by: CharlieBrady on April 30, 2009, 03:03:05 PM: That looks fine - create the junkmail folder if required, and then deliver the message to it.

What do you see with:

cat ~garyc/.qmail

?
Title: Re: help: undelivered email
Post by: ltwally on April 30, 2009, 03:48:32 PM: Quote from: CharlieBrady on April 30, 2009, 03:03:05 PM
That looks fine - create the junkmail folder if required, and then deliver the message to it.

What do you see with:

cat ~garyc/.qmail

?

Code: [Select]
[root@SERVER ~]# cat ~garyc/.qmail #------------------------------------------------------------ # !!DO NOT MODIFY THIS FILE!! # # Manual changes will be lost when this file is regenerated. # # Please read the developer's guide, which is available # at http://www.contribs.org/development/ # # Copyright (C) 1999-2006 Mitel Networks Corporation #------------------------------------------------------------ | condredirect garyc-junkmail headermatch 'X-Spam-Status: Yes' # Forward not set ./Maildir/
Title: Re: help: undelivered email
Post by: ltwally on April 30, 2009, 03:50:05 PM: Quote from: CharlieBrady on April 30, 2009, 03:03:05 PM
That looks fine - create the junkmail folder if required, and then deliver the message to it.

The folder is already there. It has some stuff in it - just not stuff from 'wes'. :sad: