Email is shown as "Accepted" in the exim log but not delivered to Inbox or mail/cur folder

gpa

Member
Feb 15, 2010
20
0
51
Hi...

I have some incoming emails that are going astray.
WHM mail delivery log, and exim_mainlog show no problems.
I've disabled spam assassin.

WHM Mail deliver log shows:

Router:virtual_user
Transport:dovecot_virtual_delivery
Out Time:May 24, 2021, 11:56:11 AM
ID:1ll8Ff-0000yO-2f
Delivery Host:localhost
Delivery IP:127.0.0.1
Size:3.35 KB
Result:Accepted


2021-05-24 11:56:02 1ll8Ff-0000yO-2f <= xxx.xxxx.co.uk H=mailzzz.megamailservers.eu (mailzzz.megamailservers.eu) [91.136.14.57]:33904 P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=3435 id=[email protected] T="Re: " for [email protected]
2021-05-24 11:56:02 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1ll8Ff-0000yO-2f
2021-05-24 11:56:02 SMTP connection from mailzzz.megamailservers.eu (mailzzz.megamailservers.eu) [91.136.14.57]:33904 closed by QUIT
2021-05-24 11:56:02 1ll8Ff-0000yO-2f => yyy <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> 6OWGFEKGq2CIDgAAsQrAGw Saved"
2021-05-24 11:56:02 1ll8Ff-0000yO-2f Completed

yyy etc is my user, and domain, redacted.
xxx etc is similarly the sender.

However the file is not is mail/domain/yyy/cur, and never arrived in inbox.

And WHM Mail delivery log, read mail, says " The system failed to locate the message with Message ID “1ll8Ff-0000yO-2f”. "

The same sender sent another mail 4 minutes later, which is fine.

This happens regularly, mails disappearing, not just this one.

Any idea what had happened? How does the ID correlate to filenames in the mail folder (if I knew that I could try searching for it perhaps?)

Thanks for any help...
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,519
1,028
313
cPanel Access Level
Root Administrator
Hey there! That's definitely odd. The easiest way to find any trace of the message would be to search for the mail ID in /home/username/email and see if there is an entry for that. The mail ID in your example is 1ll8Ff-0000yO-2f.
 

gpa

Member
Feb 15, 2010
20
0
51
The files in the /home/username/..../mail/cur folder use a different naming convention, without showing the ID

Like 1621893582.M353605P16950.servername.co.uk,S=21818,W=22428_2,S
The start of that is the unix time stamp, but otherwise it bears no obvious relation to the email ID in WHM.

There's no file email in the folder to match the one that has that ID - there are mails with timestamps either side of the missing one so I know it's not there.
If someone knows how the ID correlates to filenames in the mail folder then I could search elsewhere - see if has been misfiled.
I have checked the spam, junk etc folders and it's not there....
 

gpa

Member
Feb 15, 2010
20
0
51
A key debug thing - and surely cPanel know this - it's used by WHM in the mail lookup:

How does the email ID correlate to the saved email filename?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,519
1,028
313
cPanel Access Level
Root Administrator
It doesn't correlate to the filename at all, but you'd be able to see the mail ID within the message. Here is an example from my personal server showing this:

Code:
# grep -Ri 1llXH8-0005oq-Vi /home/username/mail/domain.com/cptest/
/home/username/mail/domain.com/cptest/new/1621949960.M126932P22478.host.servername.com,S=10901,W=11094:    id 1llXH8-0005oq-Vi
 

gpa

Member
Feb 15, 2010
20
0
51
Thanks...
Well, that eliminates one potential
grep -Ri 1ll8Ff-0000yO-2f /home/
Took a while, unsurprisingly! - but returns no hits - so it's not just misfiled.