Cant receive an email, not filtered

[Arvy]

I cant receive a message, sender is whitelisted and there are no filters. Exim shows "completed" but there are no destination, message just disappeared.

Any ideias?

2020-02-06 19:34:47 SMTP connection from [200.142.128.52]:14897 (TCP/IP connection count = 1)
2020-02-06 19:34:49 H=darth.vivo.com.br [200.142.128.52]:14897 Warning: [email protected]
2020-02-06 19:34:52 1izpjX-0005f5-0k H=darth.vivo.com.br [200.142.128.52]:14897 Warning: "SpamAssassin as inweb detected message as NOT spam (-96.9)"
2020-02-06 19:34:52 1izpjX-0005f5-0k <= [email protected] H=darth.vivo.com.br [200.142.128.52]:14897 P=esmtps X=TLSv1.2:AES128-SHA256:128 CV=no S=6474 [email protected] T="Recupera\347\343o de Senha" for [email protected]
2020-02-06 19:34:52 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1izpjX-0005f5-0k
2020-02-06 19:34:52 1izpjX-0005f5-0k Completed
2020-02-06 19:34:52 SMTP connection from darth.vivo.com.br [200.142.128.52]:14897 closed by QUIT

 

[Arvy]

SOLVED. Hmmmm, I found the problem but appears to be a bug.

There was a GLOBAL filter to "vivo.com.br" (if "from" contains... redirect to another email). BUT, the email does not exist anymore.

Exim should bounce, or at least log the exclusion... but it just ignore, no log, no bounce, nothing. Not even a "unknown user on redirect" log...

 

[cPanelLauren]

Well I wouldn't think this is a bug, if from contains X and it did in fact contain X it would get forwarded no matter the status of the recipient mailbox

What is the output of the following:

exigrep 1izpjX-0005f5-0k /var/log/exim_mainlog

And standard logging should log filters but you could enable more logging by adding log_selector = +all to /etc/exim.conf.local

 

[Arvy]

Hello @cPanelLauren

Exim should, at least, log something... to help find out what happened.

[[email protected] ~]# exigrep 1izpjX-0005f5-0k /var/log/exim_mainlog
2020-02-06 19:34:52 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1izpjX-0005f5-0k

2020-02-06 19:34:52 1izpjX-0005f5-0k H=darth.vivo.com.br [200.142.128.52]:14897 Warning: "SpamAssassin as inweb detected message as NOT spam (-96.9)"
2020-02-06 19:34:52 1izpjX-0005f5-0k <= [email protected] H=darth.vivo.com.br [200.142.128.52]:14897 P=esmtps X=TLSv1.2:AES128-SHA256:128 CV=no S=6474 [email protected] T="Recupera\347\343o de Senha" for [email protected]
2020-02-06 19:34:52 1izpjX-0005f5-0k Completed

 

[cPanelLauren]

Based on the SpamAssassin score it appears that the originating domain/ip is whitelisted. Also based on the log output you're showing I do not see a cPanel or WHM filter or forward involved. As I mentioned before, this is logged in the standard log output - In the event you receive an email that activates one of your filters, the standard logging does output this.

This transaction doesn't look like a full mail transaction either the login is usually sent when you're sending a message, not when receiving one and there are several lines of the transaction not being shown.