Unable to receive emails from one mailbox only - All the other ones work just fine

Hi Team,
I had a look at this issue in your forum but I couldn’t find a proper answer. I hope you can assist as you brilliantly did in the past.

INTRODUCTION

ISSUE

  • Inbound emails sent by any Internet Mail Provider (GMail, Yahoo, iCloud, etc…) sent to the email accounts highlighted in bold above (only users from dummy1.com mail domain) are currently not getting delivered
  • Outbound emails sent by each and every single email account to any valid email address in the Internet (including the ones from dummy1.com mail domain) are getting delivered with no problem
  • As indicated above the issue is only for one mail domain only
  • However, emails sent “locally” so basically from any email account belonging to dummy2.com, dummy3.com, dummy4.com and dummy5.com to each and every user in dummy1.com get delivered correctly
  • The problem is clearly related to dummy1.com only

FOLLOWED TROUBLESHOOTING

  • Performed tests as indicated in the above section
  • Deleted entire domain dummy1.com, re-created and re-issued a valid SSL certificate
  • Tested again and the issue was still there
  • The following appears VERY FREQUENTLY in /var/log/roundcube/errors.log:
[dd-mmm-yyyy hh:mm:ss UTC] PHP Warning:  Undefined array key "ssl_mode" in /var/lib/roundcube/program/lib/Roundcube/rcube_imap_generic.php on line 1053
  • Rebooted the server
  • Nothing relevant in /var/log/roundcube/imap.log

ENVIRONMENT

  • OS: Ubuntu 22.04
  • HestiaCP: v1.6.11

Thanks in advance.

  1. Run update apt update && apt upgrade

  2. Send an email from gmail to [email protected] And check the the headers of the return message

  3. Check at the same time /var/log/exim4/mainlog (tail -f -s0.1 /var/log/exim4/mainlog )

Hi @eris ,
Done.
The issue is still there. Here it is the content of /var/log/exim4/mainlog:

2023-01-07 20:14:54 no host name found for IP address 46.148.40.77
2023-01-07 20:15:01 dovecot_login authenticator failed for (localhost) [46.148.40.77]: 535 Incorrect authentication data (set_id=prestige)
2023-01-07 20:15:08 Start queue run: pid=19653
2023-01-07 20:15:08 1pDaKg-0015L8-Oz Message is frozen
2023-01-07 20:15:08 End queue run: pid=19653

Any clue?

Those error are from spammers. Did you send an email via gmail?

Hi @eris ,

Did you send an email via gmail?
Yes I did and the issue is still the same :frowning:

And what does the headers say from the return mail?

and is there anything in the mainlog?

Sending the email should give is information on what is wrong.

Also without the domain with the issue it is for us hard to test what is going wrong…

Sorry guys. I was busy working on something else today. Thanks for your comments so far.


@eris
Q1: And what does the headers say from the return mail?
A1: If by “return mail” you intend the email the my GMail account receives, this is what it shows:

Delivered-To: [email protected]
Received: by 2002:a0c:fe05:0:b0:531:b260:dc5a with SMTP id x5csp2354092qvr;
        Sun, 8 Jan 2023 04:22:39 -0800 (PST)
X-Received: by 2002:ac8:47c4:0:b0:3a7:e1d5:3429 with SMTP id d4-20020ac847c4000000b003a7e1d53429mr80098715qtr.22.1673180558836;
        Sun, 08 Jan 2023 04:22:38 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1673180558; cv=none;
        d=google.com; s=arc-20160816;
        b=EAJY4nvLXwrKlPsq+asdfsafdsafsafsafsff+L9K9WqTde1fQ88bKJ88HFkHspIKCN
         A0zlSGg1uXl/zhPzZIV/f2ZzroiPVfrEPdz6hOSkoxoUOdzTZljRqm4+USm2A9gQ5Cdi
         nQd3YxikQNC0PKspdHR/vYCKjeqKPcigcqYLV8JLx/Ak6WN0mmTINZClg06ZMaIgN+mV
         nsBI0ys55zP8VjB4G4s/lT2QCozuXiLuM15i9XrMvYilcQKQcXUrOx8YktfnGwUDR+PQ
         ry2r5AmnaMSTq7RY6v+gIKMQSJyd/WJ+DnZlWNjqJGuJxDMlykBUYZjOjZmU1yr57rIJ
         +8Aw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:dkim-signature;
        bh=w22kEk8vutSXxO19/A8BmRACOJ4CnJId8y/i8/LIgns=;
        b=RjkuXZb3amre7xYKb3V7mtay2WICrvDIEZ+NVNcdTyo2gYu7Zt1ZYtcjkAWRmHnc0g
         BosyH86czU92L56S9+HWRx6p5m5/BvTL3vI0zCCfbjMaeDSwjhTrvDi6zWgjnPdB99VJ
         YaZYrdqdtjamFsafasfdsafsafsafqwerfasfdasecE3GGJjY0oqOPVu2rH2/Hlp8s42
         eujoQQxOTxXWcDmoMb7mUfvX98XWoWTyn63L3OAewCMgkWAwcQC66eOJPZihvBnZvChw
         8JIQ8pljaFhdGkUvAkOZZrfOh8S+jPU3EQCaVBKyuprI1yV6+NFKpA/akMWPtZSmcpwM
         OmqQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=20210112 header.b=VnWSKBLW;
       spf=none (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com
Return-Path: <>
Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id c25-20020a37e119000000b006ecb1aa5986sor2502386qkm.116.2023.01.08.04.22.38
        for <[email protected]>
        (Google Transport Security);
        Sun, 08 Jan 2023 04:22:38 -0800 (PST)
Received-SPF: none (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) client-ip=209.85.220.69;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=20210112 header.b=VnWSKBLW;
       spf=none (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=20210112;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:from:to:cc:subject:date:message-id:reply-to;
        bh=w22kEk8vutSXxO19/A8BmRACOJ4CnJId8y/i8/LIgns=;
        b=VnWSKBLWasFGHGSSJ4mTooELN23EFYCHKcoOKauIwXVyhhnvKeeDO8GPzahACawMpU
         XFr6h1CrcyadfsadfsdXFr6h1CrcyaSI2/6e4n5Ca88ENWFKpNLE5a00WY7OXIgztsdY
         SHjnmmoBX5MnGar3dZFXFr6h1CrcyaSI2/6e4n5CBGVOB6QzntkD6y2XiU+f2VpW7+8Z
         LXYxA7mJMYmsc9JnsVlPDngjKVCnLH41RHwaArke9dRMQdfhoULNG3eTYir90/ua9E9C
         aMoujiRE3+ai1MZ3qwz1L/vexNrMOy8FfGG5S9YzD5/hhgtVHOKw2csCr7pwgSkAw3Uv
         I6IQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=w22kEk8vutSXxO19/A8BmRACOJ4CnJId8y/i8/LIgns=;
        b=HsAedS0+os6GA8Hb+BhDeIicKcffxnsZHvlUaXwyFJG6MlxYWnpUB0BqcbdoYOFids
         J+REjoLjvugEyEpTibANI6B/fxmH9zsadfsafs7Hri6BRYrvoJ6p68Hlv6bawa+IRhQj
         lvmitL8vQ7dRr6bN+UeRlDChglyaXl2c8NkABN8sWUvs3ev2FpyxzSbuez1SYNB+qjlt
         KuOGGuMF3/MYjgNNG4LRAMBt+6JFASFDKJHlkh2nzDN3EchRzSB8GeEkmMdTSW9CmHTC
         ptcmem8BfBgrf5tJ2hiuOdylGPM4RbgeGYth54YN/2uO84BaoqEuCgfjQErIdOvf+v0F
         jJrQ==
X-Gm-Message-State: AFqh2koYttBMzpTTWbtjKN6ah8d96VU8WrXjB78OHvXYfQqdqRzpDXwa M2Pixopnasgt0vp1sIzaUgHbp3RR8ZlfppmXBkw6
X-Google-Smtp-Source: AMrXdXun1JjGnN+iZFEBbqXei4ikY/wCk/lVM1ByNEn/FrwCFwwIVLjJHRUDww+zbHK/IT9a3jz9U0MIKf74lHibNCziC785PVzilQ==
X-Received: by 2002:a05:620a:2150:b0:702:698:9025 with SMTP id m16-20020a05620a215000b0070206989025mr3940822qkm.498.1673180558602;
        Sun, 08 Jan 2023 04:22:38 -0800 (PST)
Content-Type: multipart/report; boundary="000000000000d71ebc05f1bfb48e"; report-type=delivery-status
To: [email protected]
Received: by 2002:a05:620a:2150:b0:702:698:9025 with SMTP id m16-20020a05620a215000b0070206989025mr5490930qkm.498; Sun, 08 Jan 2023 04:22:38 -0800 (PST)
Return-Path: <>
Auto-Submitted: auto-replied
Message-ID: <[email protected]>
Date: Sun, 08 Jan 2023 04:22:38 -0800 (PST)
From: Mail Delivery Subsystem <[email protected]>
Subject: Delivery Status Notification (Delay)
References: <[email protected]om>
In-Reply-To: <[email protected]om>

--000000000000d71ebc05f1bfb48e
Content-Type: multipart/related; boundary="000000000000d72a1c05f1bfb48f"

--000000000000d72a1c05f1bfb48f
Content-Type: multipart/alternative; boundary="000000000000d72a2705f1bfb490"

--000000000000d72a2705f1bfb490
Content-Type: text/plain; charset="UTF-8"


** Delivery incomplete **

There was a temporary problem while delivering your message to [email protected] Gmail will retry for 47 more hours. You'll be notified if the delivery fails permanently.



The response from the remote server was:
451 relay not permitted!

Also this is the content of the return email in GMail:
image


@ScIT
Q2: and is there anything in the mainlog?
A2: Nothing relevant in the /var/log/exim4/mainlog file. Just a bunch of messages like these

yyyy-mm-dd hh:mm:ss no host name found for IP address 46.148.40.189
yyyy-mm-dd hh:mm:ss dovecot_login authenticator failed for (localhost) [46.148.40.189]: 535 Incorrect authentication data (set_id=domaincontrolpanel)
yyyy-mm-dd hh:mm:ss dovecot_login authenticator failed for ([141.98.10.48]) [141.98.10.48]: 535 Incorrect authentication data (set_id=xerox)

@eris
Q3: Also without the domain with the issue it is for us hard to test what is going wrong…
A3: The mail domain is xxxx.com. I have just created a new dummy user called: [email protected] (in case you want to do some tests). In the meantime I am going to check the DNS records as they are managed by siteground.com for this mail domain only


ATTENTION: Please note that the logs above have been a little bit cleaned for privacy reasons!

If I send an email to [email protected] I get

2023-01-08 18:54:01 1pEZrf-003nif-2G == [email protected] R=dnslookup T=remote_smtp defer (-44) H=mx30.mailspamprotection.com [185.56.84.24]: SMTP error from remote mail server after RCPT TO:<[email protected] >: 451 relay not permitted!

It looks like you are still using mx30.mailspamprotection.com from site ground as your mail server…

2 Likes

Hi @eris,

Issue resolved after correcting MX records for the affected mail domain in siteground.com (had to wait ~20 hours though).

Thanks for your help.

Have a lovely day!