Mail from Outside our Domain not Stored
Lamar Milligan
lmilligan at co.walton.ga.us
Thu Jun 13 13:15:55 UTC 2019
Here are maillog extracts from our sendmail server for messages to and from
my Gmail account. I did hide my Gmail address in the logs.
[root at mail log]# grep address maillog|grep Jun\ 13
Jun 13 08:51:35 mail sendmail[29638]: x5DCpZVS029638:
to=<address at gmail.com>, delay=00:00:00, mailer=esmtp, pri=35430, stat=queued
Jun 13 08:51:37 mail MailScanner[20868]: Delivery of nonspam: message
x5DCpZVS029638 from lmilligan at co.walton.ga.us to address at gmail.com with
subject Test Message
Jun 13 08:52:37 mail sendmail[29653]: x5DCpZVS029638: to=<
address at gmail.com>, delay=00:01:02, xdelay=00:01:00, mailer=esmtp,
pri=125430, relay=gmail-smtp-in.l.google.com. [64.233.185.27], dsn=2.0.0,
stat=Sent (OK 1560430357 a64si1019447yba.91 - gsmtp)
Jun 13 08:53:23 mail sendmail[29857]: x5DCrN44029857: from=<
address at gmail.com>, size=4489, class=0, nrcpts=1,
msgid=<CAEqc0zk7k5Q9FiM6VUk-P8oKBhpgWOqcCBQd3-U-HepE=5Enew at mail.gmail.com>,
proto=ESMTP, daemon=MTA, relay=mail-qk1-f180.google.com [209.85.222.180]
Jun 13 08:53:26 mail MailScanner[27531]: Message x5DCrN44029857 from
209.85.222.180 (address at gmail.com) to co.walton.ga.us is not spam,
SpamAssassin (not cached, score=-1.998, required 5, autolearn=not spam,
BAYES_00 -1.90, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10,
FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, SPF_HELO_NONE 0.00, SPF_PASS -0.00)
Jun 13 08:53:26 mail MailScanner[27531]: Delivery of nonspam: message
x5DCrN44029857 from address at gmail.com to lmilligan at co.walton.ga.us with
subject Re: Test Message
[root at mail log]# grep x5DCpZVS029638 maillog
Jun 13 08:51:35 mail sendmail[29638]: x5DCpZVS029638:
from=<lmilligan at co.walton.ga.us>, size=5430, class=0, nrcpts=1,
msgid=<000001d521e6$bb9dbfd0$32d93f70$@co.walton.ga.us>, bodytype=7BIT,
proto=ESMTP, daemon=MTA, relay=zimbra1 [192.168.32.47]
Jun 13 08:51:35 mail opendkim[2320]: x5DCpZVS029638: DKIM-Signature field
added (s=FEA62E10-BFE6-11E7-BA2D-46CD2CC478D5, d=co.walton.ga.us)
Jun 13 08:51:35 mail sendmail[29638]: x5DCpZVS029638: Milter insert (1):
header: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
d=co.walton.ga.us;\n\ts=FEA62E10-BFE6-11E7-BA2D-46CD2CC478D5;
t=1560430295;\n\tbh=CSJ2rlhIjlClMMaj7t9SswqeupTOa7unO4OXOq2PwNc=;\n\th=Reply-To:From:To:Subject:Date:From;\n\tb=uvX8sa9j4g3GZc9r94bLrYNJj4FqJoin1EItnitkB+cPWrAKf147nfTTNGOofBTK8\n\t
rEPD90/OGACQwNG5VaQh433tMaB7sPSlhrfAMQsmj9hLHPZ1iUk0NDQNXn1293KqMS\n\t
naHcHSbwzQIqG7O6TrjtPaPKXWHgZ1KnJ2zpY5QQ=
Jun 13 08:51:35 mail sendmail[29638]: x5DCpZVS029638: Milter insert (1):
header: DKIM-Filter: OpenDKIM Filter v2.11.0 mail.co.walton.ga.us
x5DCpZVS029638
Jun 13 08:51:35 mail sendmail[29638]: x5DCpZVS029638: to=<
address at gmail.com>, delay=00:00:00, mailer=esmtp, pri=35430, stat=queued
Jun 13 08:51:37 mail MailScanner[20868]: Message x5DCpZVS029638 from
192.168.32.47 (lmilligan at co.walton.ga.us) to gmail.com is not spam,
SpamAssassin (not cached, score=-2.699, required 5, ALL_TRUSTED -1.00,
BAYES_00 -1.90, DKIM_INVALID 0.10, DKIM_SIGNED 0.10, HTML_MESSAGE 0.00)
Jun 13 08:51:37 mail MailScanner[20868]: Delivery of nonspam: message
x5DCpZVS029638 from lmilligan at co.walton.ga.us to address at gmail.com with
subject Test Message
Jun 13 08:51:37 mail MailScanner[20868]: MailWatch: Logging message
x5DCpZVS029638 to SQL
Jun 13 08:51:37 mail MailScanner[29472]: MailWatch: x5DCpZVS029638: Logged
to MailWatch SQL
Jun 13 08:52:37 mail sendmail[29653]: x5DCpZVS029638: to=<
address at gmail.com>, delay=00:01:02, xdelay=00:01:00, mailer=esmtp,
pri=125430, relay=gmail-smtp-in.l.google.com. [64.233.185.27], dsn=2.0.0,
stat=Sent (OK 1560430357 a64si1019447yba.91 - gsmtp)
[root at mail log]# grep x5DCrN44029857 maillog
Jun 13 08:53:23 mail sendmail[29857]: x5DCrN44029857: from=<
address at gmail.com>, size=4489, class=0, nrcpts=1,
msgid=<CAEqc0zk7k5Q9FiM6VUk-P8oKBhpgWOqcCBQd3-U-HepE=5Enew at mail.gmail.com>,
proto=ESMTP, daemon=MTA, relay=mail-qk1-f180.google.com [209.85.222.180]
Jun 13 08:53:23 mail opendkim[2320]: x5DCrN44029857:
mail-qk1-f180.google.com [209.85.222.180] not internal
Jun 13 08:53:23 mail opendkim[2320]: x5DCrN44029857: not authenticated
Jun 13 08:53:23 mail opendkim[2320]: x5DCrN44029857: DKIM verification
successful
Jun 13 08:53:23 mail sendmail[29857]: x5DCrN44029857: Milter insert (1):
header: Authentication-Results: mail.co.walton.ga.us;\n\tdkim=pass
(2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QvRSmgcU"
Jun 13 08:53:23 mail sendmail[29857]: x5DCrN44029857: Milter insert (1):
header: DKIM-Filter: OpenDKIM Filter v2.11.0 mail.co.walton.ga.us
x5DCrN44029857
Jun 13 08:53:26 mail MailScanner[27531]: Message x5DCrN44029857 from
209.85.222.180 (address at gmail.com) to co.walton.ga.us is not spam,
SpamAssassin (not cached, score=-1.998, required 5, autolearn=not spam,
BAYES_00 -1.90, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10,
FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, SPF_HELO_NONE 0.00, SPF_PASS -0.00)
Jun 13 08:53:26 mail MailScanner[27531]: Delivery of nonspam: message
x5DCrN44029857 from address at gmail.com to lmilligan at co.walton.ga.us with
subject Re: Test Message
Jun 13 08:53:26 mail MailScanner[27531]: MailWatch: Logging message
x5DCrN44029857 to SQL
Jun 13 08:53:26 mail MailScanner[29472]: MailWatch: x5DCrN44029857: Logged
to MailWatch SQL
Jun 13 08:53:26 mail sendmail[29883]: x5DCrN44029857:
to=lmilligan at zimbra1.co.walton.ga.us, delay=00:00:03, xdelay=00:00:00,
mailer=esmtp, pri=124489, relay=zimbra1.co.walton.ga.us. [192.168.32.47],
dsn=2.0.0, stat=Sent (Ok: queued as 7A9B2E17EE)
I hope there is something in here that explains this behavior, but I cannot
see it. Thanks so much for looking at this, it has bugged me for months!
Lamar
From: MailScanner
<mailscanner-bounces+lmilligan=co.walton.ga.us at lists.mailscanner.info> On
Behalf Of Shawn Iverson via MailScanner
Sent: Wednesday, June 12, 2019 7:34 PM
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Cc: Shawn Iverson <iversons at rushville.k12.in.us>
Subject: Re: Mail from Outside our Domain not Stored
Hehe, missed that line, so the line is being read, this is very bizzare...
In any case, maillogs are going to be the next logical step.
On Wed, Jun 12, 2019 at 5:09 PM Antony Stone
<Antony.Stone at mailscanner.open.source.it
<mailto:Antony.Stone at mailscanner.open.source.it> > wrote:
On Wednesday 12 June 2019 at 22:32:28, Shawn Iverson via MailScanner wrote:
> I do see a subtle clue...
>
> 1) The "X-Spam-Status: No" is actually not present.
Erm, yes it is?
X-Spam-Status: No, score=3.451 required=6
tests=[ALL_TRUSTED=-1,BAYES_50=0.8,
DKIM_SIGNED=0.1, DKIM_VALID=-0.1,HEADER_FROM_DIFFERENT_DOMAINS=0.25,
LOCAL_COUNTRY=2.2, LOCAL_NOTFROM_TTLD=2.2, MAILING_LIST_MULTI=-1,
SPF_HELO_NONE=0.001] autolearn=no autolearn_force=no
> "X-Spam-Flag: NO" is actually coming from amavisd-new on the next hop (the
> Zimbra mail server itself, I think) and hence why it is so far up in the
> Received chain.
Indeed - that's different.
> 2) Becuase X-Spam-Status is not there, the Non Spam Actions appears to
> have
> been ignored for some reason.
I'm not so sure (but then again I'm not at all sure about this one).
> At this point, we are going to need a maillog of an inbound message that
> fails to get quarantined, along with a maillog of an outbound message that
> is being quarantined for further clues.
Sounds good to me.
Antony.
--
"Remember: the S in IoT stands for Security."
- Jan-Piet Mens
Please reply to the list;
please *don't* CC
me.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
<mailto:mailscanner at lists.mailscanner.info>
http://lists.mailscanner.info/mailman/listinfo/mailscanner
--
Shawn Iverson, CETL
Director of Technology
Rush County Schools
765-932-3901 option 7
iversons at rushville.k12.in.us <mailto:iversons at rushville.k12.in.us>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190613/2cc418a3/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ~WRD000.jpg
Type: image/jpeg
Size: 823 bytes
Desc: not available
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190613/2cc418a3/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 440 bytes
Desc: not available
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190613/2cc418a3/attachment-0001.jpg>
More information about the MailScanner
mailing list