[PLUG] Incomplete Incoming Mail Processing

ckonstanski at pippiandcarlos.com ckonstanski at pippiandcarlos.com
Fri Mar 20 18:54:28 UTC 2009


>    I've been expecting an e-mail message that's not shown up in my inbox.
> I
> grepped /var/log/maillog for the domain and found a record for a partial
> transaction:
>
> Mar 20 10:52:12 salmo postfix/qmgr[11647]: 5730AE7:
> from=<aaaaa.bbbbb at ccccc.net>, size=6636, nrcpt=1 (queue active)
>
>    What does this tell you more expert gurus? There's no EHLO, no
> indication
> that the transaction was completed, and no rejection. Any ideas?
>
> Thanks,
>
> Rich

Below is a normal looking postfix SMTP connection for incoming mail (mine
has amavisd; you may not see some of these lines).  Notice that the qmgr
line does not appear until after a few smtpd lines.  You say you grepped
/var/log/maillog.  How about cracking that sucker open and seeing what
other log entires are there?  It seems like you'd have to have a "connect
from" entry a few lines before the one you found.

If you have the luxury, the surest way to troubleshoot SMTP issues is with
telnet.  If you can prove that it is possible to send an email in this way
from the client's location, then the problem is with the client's MUA. 
(If your postfix requires TLS, you will have to generate a STARTTLS
string; you can do this with a perl one-liner.)  For instance, I've seen
where the Mac-bundled MUA doesn't deal with TLS worth a crap, at least
when a self-signed cert is involved.  This results in the connection being
dropped (or hanging?) before the point where STARTTLS is normally issued.

Just for fun, type "mailq" just to see if the email is sitting in you
local queue.  This is highly unlikely, but what the heck.

Couldn't hurt to make sure that the IP address of the client isn't in
/etc/hosts.deny.  Perhaps you're running denyhosts, and they tried to hack
you in the past.


Mar 20 12:28:17 ns postfix/smtpd[10666]: connect from
haus.nakedape.cc[76.76.148.5]
Mar 20 12:28:17 ns postfix/smtpd[10666]: NOQUEUE: filter: RCPT from
haus.nakedape.cc[76.76.148.5]: <plug-bounces at lists.pdxlinux.org>: Sender
address triggers FILTER smtp-amavis:[127.0.0.1]:10024;
from=<plug-bounces at lists.pdxlinux.org> to=<ckonstanski at pippiandcarlos.com>
proto=ESMTP helo=<ulke.nakedape.cc>
Mar 20 12:28:17 ns postfix/smtpd[10666]: EF7CD181610:
client=haus.nakedape.cc[76.76.148.5]
Mar 20 12:28:19 ns postfix/cleanup[10673]: EF7CD181610:
message-id=<alpine.LNX.2.00.0903201125180.23207 at salmo.appl-ecosys.com>
Mar 20 12:28:19 ns postfix/qmgr[9367]: EF7CD181610:
from=<plug-bounces at lists.pdxlinux.org>, size=4613, nrcpt=1 (queue active)
Mar 20 12:28:19 ns postfix/smtpd[10666]: disconnect from
haus.nakedape.cc[76.76.148.5]
Mar 20 12:28:19 ns amavis[8036]: (08036-08) (!!)WARN: all primary virus
scanners failed, considering backups
Mar 20 12:28:23 ns postfix/smtpd[10714]: sql auxprop plugin using pgsql
engine
Mar 20 12:28:23 ns postfix/smtpd[10714]: connect from
localhost.localdomain[127.0.0.1]
Mar 20 12:28:23 ns postfix/smtpd[10714]: 9EDF3182024:
client=unknown[76.76.148.5]
Mar 20 12:28:23 ns postfix/cleanup[10673]: 9EDF3182024:
message-id=<alpine.LNX.2.00.0903201125180.23207 at salmo.appl-ecosys.com>
Mar 20 12:28:23 ns postfix/qmgr[9367]: 9EDF3182024:
from=<plug-bounces at lists.pdxlinux.org>, size=4879, nrcpt=1 (queue active)
Mar 20 12:28:23 ns postfix/smtpd[10714]: disconnect from
localhost.localdomain[127.0.0.1]
Mar 20 12:28:23 ns amavis[8036]: (08036-08) Passed CLEAN, [76.76.148.5]
[216.99.206.23] <plug-bounces at lists.pdxlinux.org> ->
<ckonstanski at pippiandcarlos.com>, Message-ID:
<alpine.LNX.2.00.0903201125180.23207 at s
almo.appl-ecosys.com>, mail_id: TcAoQ81B4kl6, Hits: 0, size: 4576,
queued_as: 9EDF3182024, 4581 ms
Mar 20 12:28:23 ns postfix/qmgr[9367]: 9EDF3182024: removed
Mar 20 12:28:23 ns postfix/virtual[10718]: 9EDF3182024:
to=<ckonstanski at pippiandcarlos.com>, relay=virtual, delay=0.07,
delays=0.02/0.01/0/0.04, dsn=2.0.0, status=sent (delivered to maildir)
Mar 20 12:28:23 ns postfix/qmgr[9367]: EF7CD181610: removed
Mar 20 12:28:23 ns postfix/smtp[10675]: EF7CD181610:
to=<ckonstanski at pippiandcarlos.com>, relay=127.0.0.1[127.0.0.1]:10024,
delay=5.7, delays=1.2/0/0.01/4.6, dsn=2.0.0, status=sent (250 2.0.0 Ok,
id=08036-08,
from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 9EDF3182024)


Carlos




More information about the PLUG mailing list