The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

cc email not delivered to mailbox

Discussion in 'E-mail Discussions' started by keat63, Mar 13, 2015.

  1. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I've been asked why someone didn't receive an email.

    We had a customer who attempted to send an email to one of my colleges.
    I can see in the mail log, that he is on an RBL so this was rejected.

    I also see 15 minutes later that he sent another message, so I'm assuming he must have seen a blacklist bounce, and tried again.

    Only this time the message was delivered, which makes no sense as he sent from the same IP address (unless he somehow had the blacklist lifted in this short space of time )

    Then to confuse matters, looking on the end users outlook screen, I can see that he CC'd someone else in, who didn't receive it, and I can't see any reference to the CC in the exim mainlog.

    The second user has no filters configured, and nothing in outlook.

    I'm confused.
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Did you try searching entering the IP address in the RBL's website to see if it's still listed?

    Thank you.
     
  3. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I never thought of that to be honest, as I was more concerned with where the CC went.
    I have now checked Spamcop and he's not blacklisted, so maybe he did indeed delist.

    However, i'm still at a loss where the CC went.
    I can see the message headers from the client PC and can clearly see the CC.
    But noting in Exim Main Log referring to a CC.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Do you see any entries for the email address that was CC'd in /var/log/exim_mainlog? EX:

    Code:
    exigrep cc'd-email@domain /var/log/exim_mainlog
    Thank you.
     
  5. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I can't see anything in that log against that recipient, either for the message ID or the senders email, however it's clearly visible from one end users PC.

    Code:
    Received: from [79.xxx.xx.xx] (helo=AndrewPC)
    
      by mail149.extendcp.com with esmtpa (Exim 4.80.1)
    
      id 1YWO1h-0003Oz-Md; Fri, 13 Mar 2015 11:45:17 +0000
    
    From: "Andrew Customer" <andrew@sender.co.uk>
    
    To: <nicky@mydom.co.uk>
    
    Cc: <janine@mydom.co.uk>
    [\code]
    
    
     
    #5 keat63, Mar 13, 2015
    Last edited: Mar 13, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Could you have the user try making that delivery again, or can you reproduce the issue with your own email client? If the email address is not found in /var/log/exim_mainlog, it typically indicates that Exim did not process the message.

    Thank you.
     
  7. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I did try a test before i left the office sending an email to nicky with a cc to janine from an unrelated domain sitting on a totally different server, and this was delivered to both accounts.
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    It seems like it might be isolated to that individual email client. Check to see if the user can reproduce the issue with another email.

    Thank you.
     
  9. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    When you say email client, I assume you mean Outlook ?
    That wouldn't explain why I can find it exim logs though.


    looking at the first few entries, could it have gone through some sort of relay, and maybe stripped something out?

    Message Headers

    Code:
    Received: from mailscan34.extendcp.co.uk ([79.xxx.xx.x]:45890 helo=mailscan1.extendcp.co.uk)
    
                by my.hostname.co.uk with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)
    
                (Exim 4.85)
    
                (envelope-from <andrew@customer-domain.co.uk>)
    
                id 1YWOHb-00023E-7v
    
                for nicky@mydom.co.uk; Fri, 13 Mar 2015 12:01:41 +0000
    
    Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mailscan1.hi.local)
    
                by mailscan-g71.hi.local with esmtp (Exim 4.80.1)
    
                (envelope-from <andrew@customer-domain.co.uk>)
    
                id 1YWO2l-0005K7-Ug; Fri, 13 Mar 2015 11:46:19 +0000
    
    Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mail149.extendcp.co.uk)
    
                by mailscan1.hi.local with esmtps (UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256)
    
                (Exim 4.80.1)
    
                (envelope-from <andrew@customer-domain.co.uk>)
    
                id 1YWO2W-0005Zp-8j; Fri, 13 Mar 2015 11:46:19 +0000
    
    Received: from [79.170.72.99] (helo=AndrewPC)
    
                by mail149.extendcp.com with esmtpa (Exim 4.80.1)
    
                id 1YWO1h-0003Oz-Md; Fri, 13 Mar 2015 11:45:17 +0000
    
    From: "Andrew " <andrew@customer-domain.co.uk>
    
    To: <nicky@mydom.co.uk>
    
    Cc: <janine@mydom.co.uk>
    
    Subject: Purchase Order 6730
    
    Date: Fri, 13 Mar 2015 11:45:06 -0000
    
    Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAAC6NC67g7SVOiXzfLPcm6Z/CgAAAEAAAADgatA8rPF9PkhY394ntAjkBAAAAAA==@customer-domain.co.uk>
    
    MIME-Version: 1.0
    
    Content-Type: multipart/mixed;
    
                boundary="----=_NextPart_000_0056_01D05D83.299F9E90"
    
    X-Mailer: Microsoft Outlook 15.0
    
    Content-Language: en-gb
    
    X-WatchGuard-Spam-ID: str=0001.0A0B0201.5502D245.02D4,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
    
    X-Antivirus: avast! (VPS 150312-4, 12/03/2015), Inbound message
    
    X-Antivirus-Status: Clean
    
    [\code]
     
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    It depends on the specific nature of how the user's local workstation is configured. From what I understand, the issue is isolated to this particular user's workstation. Does the issue persist when they send email from Thunderbird instead of Outlook? Is there any special email relay configured for their domain name?

    Thank you.
     
  11. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    All the PC's have MS Outlook, all configured the same.
    Nobody has any specific rules configured.
    Each Cpanel Mailbox is configured the same way (different passwords of course)

    What's confused me is on one email client, I can clearly see the CC to a colleague.
    If i look at those headers (attached above), again, I can see the CC.
    The CC never arrived, and I can't find it in exim logs, spam folders, junk folders, deleted folders.
    It's as if it was never CC'd.

    Here is the exim log for that particular email.

    Code:
    2015-03-13 12:01:38 SMTP connection from [xx.xxx.xxx.xxx]:45890 (TCP/IP connection count = 1)
    2015-03-13 12:01:38 H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: Sender rate 1.0 / 1h
    2015-03-13 12:01:39 1YWOHb-00023E-7v H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: Message has been scanned: no virus or other harmful content was found
    2015-03-13 12:01:41 1YWOHb-00023E-7v H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: "SpamAssassin as cpanel-user detected message as NOT spam (-0.0)"
    2015-03-13 12:01:41 1YWOHb-00023E-7v <= andrew@customer.co.uk H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 P=esmtps X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 S=148300 id=!&!AAAAAAAAAAAYAAAAAAAAAC6NC67g7SVOiXzfLPcm6Z/CgAAAEAAAADgatA8rPF9PkhY394ntAjkBAAAAAA==@customer.co.uk T="Purchase Order 6730" for nicky@mydom.com
    2015-03-13 12:01:41 SMTP connection from mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 closed by QUIT
    2015-03-13 12:01:41 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1YWOHb-00023E-7v
    2015-03-13 12:01:41 1YWOHb-00023E-7v => nicky <nicky@mydom.com> R=virtual_user T=virtual_userdelivery
    2015-03-13 12:01:41 1YWOHb-00023E-7v Completed
    [\code]
     
  12. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I've just been and looked again on the receivers PC, wondering if maybe it was an attached email, but it's a regular email with a CC.
    I guess there's not a great deal we can do unless we spot re-occurrences, but it would be nice to understand why it went missing.
     
  13. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    You may want to check with Outlook's support because it's not happening with other email clients and there's no mention of it in the Exim logs.

    Thank you.
     
  14. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Hi Michael.

    This is what I don't understand.
    If you look at the headers from one client PC, you can see the CC. #5 & #9
    But not in the exim logs. #11
     
  15. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    That indicates to me the issue is with the email client on that particular computer, as opposed to an issue with cPanel or Exim, since Exim never sees the message.

    Thank you.
     
  16. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    So are these logs showing the client downloading it from exim ?
    And If this is the case, is there a log anywhere that shows the message landing in the users mailbox (prior to download by the client)
     
  17. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    I'm under the assumption that you are referring to a problem the user has when "sending" a message from the desktop email client when using the "CC" option. Could you elaborate on what specific part of the log shows any aspect of that cc'd address?

    Thank you.
     
  18. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    An external customer sent an email to one user (Nicky) and CC'd another user (Janine).
    Both Nicky and Janine are users on my domain.

    Nicky received the email, and I can see from the email and its ascociated email headers that Janine was CC'd.
    Janine never received the CC.
     
    #18 keat63, Mar 18, 2015
    Last edited: Mar 18, 2015
  19. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,694
    Likes Received:
    654
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    It seems like an issue with the email client, but feel free to open a support ticket so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
  20. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Hi Michael

    Now that we've ascertained the direction of the email, is there anything i need to search for in the logs, that would indicate a CC for the missing email in question ?

    On line 22, post #9, (email headers from client PC), we can see the CC.
    Just can't seem to locate it in the exim logs.
     
Loading...

Share This Page