[Case 78981] Domain exceeded the max defers and failures per hour (5/5)

[edigest]

I looked over the other threads reporting this problem. (e.g., http://forums.cpanel.net/f43/domain...ax-defers-failures-per-hour-5-5-a-296962.html). None of the fixes applies to me.

The file /var/cpanel/email_send_limits/max_deferfail_example.com was created for a domain with no obvious issues.

There was no mass mailing which I think would be the obvious cause. Email is working fine for other domains.

What should I be looking for in the logs to figure out what triggered the original ban?

 

[cPanelMichael]

Hello

Try searching /var/log/exim_mainlog or an archive of that log file for the date the maximum defers and failures value was exceeded. EX:

grep ^2014-03-05 /var/log/exim_mainlog | awk '{print $1,$2,$3,$4,$5}' | grep \<= | grep -i @domain.com

This should output emails sent by "domain.com" during that date to help verify if the failure was a false positive.

Thank you.

 

[edigest]

Thanks for that. The reason I asked the question was that I had done that search and there were only a small number of bounced emails. So this was, indeed, a false positive.

Based on my experience and the several threads on this subject, it appears that false positives are rather common. Worse yet, there is no notification that tells me there is a problem -- other than the client who is concerned because mail is no longer working.

Seems to be something that needs to be rethought and recoded ...

 

[cPanelMichael]

There is an internal case open to address this issue, however it has not yet been reliably reproduced. For reference, the case number is 78981. Could you open a support ticket using the link in my signature so we can take a closer look and attempt to reproduce the issue on your system?

Thank you.

 

[edigest]

There is an internal case open to address this issue, however it has not yet been reliably reproduced. For reference, the case number is 78981. Could you open a support ticket using the link in my signature so we can take a closer look and attempt to reproduce the issue on your system?

I've already reconfigured the system (new IP, some changes to the ACL and changes to Exim config in WHM). If the problem comes back with this configuration I will be happy to allow you to tinker with my mail server.

Not sure if this is helpful to the internal case, but the problem with the "good" domain came up about a day after someone else tried to send out an email with about 300 cc:'s. They were blocked by Exim at the limit I had set in WHM, but ... I started getting deferred by Google and banned by some other servers. (Hence, the IP change ...)

The "good" domain (the one having the defers and failures problem) uses Gmail quite a bit and Google's mail server was delaying their mail. I haven't found a 'smoking gun' but that may have somehow triggered the defers/failures error.

 

[justjaph]

Michael,

I'm facing the same issue and the weirdest part is that the minimum limit set by "email_send_limits_min_defer_fail_to_trigger_protection" ( set to 101 ) and "email_send_limits_max_defer_fail_percentage" (set to 50 ) doesn't seem to be respected:

[~]# cat /var/cpanel/email_send_limits/max_deferfail_domain.dom
5/5 (83%)

The domain didn't send nothing close to 100 emails in a single day:

[~]# grep ^2014-05-27 /var/log/exim_mainlog | awk '{print $1,$2,$3,$4,$5}' | grep \<= | grep -i @domain.dom|wc -l
26

Anything else I can look into ?

 

[cPanelMichael]

You can open a support ticket so we can attempt to reproduce the issue and link your ticket to the internal case.

Thank you.