Existence of email order checking

[keat63]

I found an email in the queue today from a mailbox that doesn't exist.
It would appear that we had an old auto responder still configured, for an account that used to exist, so it sort of explains why there was a mail queued.

However, considering the account doesn't exists, and there's no forwarder setup, how did the original spam ever get accepted.

It seems that exim is configured to reply first and worry about the rest later.
Should it not be the other way around.. check existence of account, check existence of forwarder, if neither exists, drop the mail ?

 

[cPanelMichael]

Hello,

What is configured as the "Default Address" for this domain name (cPanel >> Default Address)?

Thank you.

 

[keat63]

all unrouted mail is configured to discard with a failure message.

 

[cPanelMichael]

It's acceptable to have an autoresponder when there's no email account associated with it, however if you do not create a forwarder or email account with the same address as the autoresponder, it will discard the message. What's the message you found in the queue, and what's it's associated entry in /var/log/exim_mainlog?

Thank you.

 

[keat63]

I removed the job from the outgoing mail queue, but i've managed to recreate the issue.
I have no account or forward rule configured for mickeymouse.
I've just created the autoresponder for this experiment.

Although I'm currently still waiting for the auto responder to reply, it seems that the message was accepted.

2015-03-13 09:25:57 SMTP connection from [xx.xxx.xxx.xxx]:16880 (TCP/IP connection count = 1)
2015-03-13 09:26:00 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: Sender rate 1.0 / 1h
2015-03-13 09:26:02 1YWLqz-0007b2-O4 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: Message has been scanned: no virus or other harmful content was found
2015-03-13 09:26:04 1YWLqz-0007b2-O4 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: "SpamAssassin as cpanel-user detected message as NOT spam (1.0)"
2015-03-13 09:26:04 1YWLqz-0007b2-O4 <= [email protected] H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 P=esmtp S=5490 [email protected] T="did this arrive" for [email protected]
2015-03-13 09:26:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1YWLqz-0007b2-O4
2015-03-13 09:26:04 1YWLqz-0007b2-O4 => |/usr/local/cpanel/bin/autorespond [email protected] /home/cpanel-user/.autorespond ([email protected]) <[email protected]> R=virtual_aliases_nostar T=jailed_virtual_address_pipe
2015-03-13 09:26:04 1YWLqz-0007b2-O4 Completed
2015-03-13 09:26:05 SMTP connection from nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 closed by QUIT

 

[cPanelMichael]

Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[keat63]

Hi Michael..

For security reasons, I removed all the firewall rules along with SSH keys from my last support ticket.
However, I'm happy to open a ticket if you're unable to reproduce this in the lab ?

 

[cPanelMichael]

First, I suggest reading the following document to get a better idea of how auto responders work with Exim:

http://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_autoreply_transport.html

While the message is discarded if you don't have an email account or forwarder, it's still normal for Exim to process the message and attempt to send the automatic response. I can't reproduce any problems with this behavior on a test system, so yes, please open a support ticket if you are seeing different behavior.

Thank you.

 

[keat63]

Despite mail delivery reports showing that the message was accepted, I never did actually receive the auto response.
I'm going to put this down to pure lazyness or oversight on my side, for leaving an auto responder in place after removing an account.