Mail Delayed sporadically

[WendyTinley]

Hi,

This is my first post as my colleague who is responsible for our mail server is on vacation, please accept my apologies for any 'green sounding' terminology.

A client of ours is complaining of sporadic mail delivery delays. All emails to [email protected] are forwarded to remote mail servers, namely [email protected]. Apart from one staff member who has a POP3 box.

The domain myclient.tld is hosted on a shared reseller type server at Heart Internet in the UK.
The A records for subdomain mail points to the IP address of a virtual server we use as a mail server.

We have done this because we cannot use SpamExperts to filter mail on the shared reseller account.

The MX records in DNS management of myclient.tld point to the mail server mx.spamexperts.com, fallbackmx.spamexperts.eu. and lastmx.spamexperts.net.

SpamExperts returns mail to mail.myclient.tld and the mail server forwards them to POP3s on Earthlink.

During their working day a handful of emails are delayed by hours. Below is an example of the delivery event details from CPanel.

[U]Delivery Event Details[/U]
[B]Event[/B]: success
[B]User[/B]: myclient
[B]Domain[/B]: myclient.tld
[B]Sender[/B]: [EMAIL][email protected][/EMAIL]
[B]Sent Time[/B]: [I][B]Apr 4, 2017 7:13:19 PM[/B][/I]
[B]Sender Host[/B]: mx50.antispamcloud.com
[B]Sender IP[/B]: 31.204.154.237
[B]Authentication[/B]: forwarder
[B]Spam Score[/B]: 0
[B]Recipient[/B]: [EMAIL][email protected][/EMAIL]
[B]Delivery User[/B]: -remote-
[B]Delivery Domain[/B]:
[B]Delivered To[/B]: [EMAIL][email protected][/EMAIL]
[B]Router[/B]: lookuphost
[B]Transport[/B]: remote_smtp
[B]Out Time[/B]: [I][B]Apr 4, 2017 10:17:22 PM[/B][/I]
[B]ID[/B]: 1cvSx3-0004mo-AV
[B]Delivery Host[/B]: mx2.earthlink.net
[B]Delivery IP[/B]: 209.86.93.227
[B]Size[/B]: 10.8 KB
[B]Result[/B]: Accepted

I am trying to figure out whether it is our mail server causing the problems or is it earthlink.net causing the issues? For instance, which mail server is responsible for issuing the Out Time?

[U]Below is the extract from exim_mainlog[/U]

2017-04-04 19:13:09 1cvSx3-0004mo-AV H=mx50.antispamcloud.com [31.204.154.237]:42846 Warning: Message has been scanned: no virus or other harmful content was found
2017-04-04 19:13:09 1cvSx3-0004mo-AV <= [EMAIL][email protected][/EMAIL] H=mx50.antispamcloud.com [31.204.154.237]:42846 P=esmtps X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=11059 [email protected]***.***.corp T="RE: subject" for [EMAIL][email protected][/EMAIL]
2017-04-04 19:13:09 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1cvSx3-0004mo-AV
2017-04-04 19:13:09 SMTP connection from mx50.antispamcloud.com [31.204.154.237]:42846 closed by QUIT
2017-04-04 19:13:09 1cvSx3-0004mo-AV SMTP connection identification D=myclient.tld [email protected] [email protected] M=1cvSx3-0004mo-AV U=servername ID=1004 B=redirect_resolver
2017-04-04 19:13:09 1cvSx3-0004mo-AV SMTP connection outbound 1491329589 1cvSx3-0004mo-AV myclient.tld [EMAIL][email protected][/EMAIL]

2017-04-04 19:16:03 1cvSx3-0004mo-AV SMTP connection identification D=myclient.tld [email protected] [email protected] M=1cvSx3-0004mo-AV U=loanledger ID=1004 B=redirect_resolver

2017-04-04 20:22:25 1cvSx3-0004mo-AV SMTP connection identification D=myclient.tld [email protected] [email protected] M=1cvSx3-0004mo-AV U=loanledger ID=1004 B=redirect_resolver

2017-04-04 21:17:19 1cvSx3-0004mo-AV SMTP connection identification D=myclient.tld [email protected] [email protected] M=1cvSx3-0004mo-AV U=loanledger ID=1004 B=redirect_resolver

2017-04-04 22:17:26 1cvSx3-0004mo-AV SMTP connection identification D=myclient.tld [email protected] [email protected] M=1cvSx3-0004mo-AV U=loanledger ID=1004 B=redirect_resolver

2017-04-04 22:17:28 1cvSx3-0004mo-AV => [EMAIL][email protected][/EMAIL] ([email protected]) <[email protected]> R=lookuphost T=remote_smtp H=mx2.earthlink.net [209.86.93.227] X=TLSv1.2:AES256-GCM-SHA384:256 CV=yes C="250 1CVvPp5LP3Nl34i0 Message accepted for delivery"
2017-04-04 22:17:28 1cvSx3-0004mo-AV Completed

I do not know if the lines below are connected to the above lines or whether part of another mail delivery.

2017-04-04 22:17:28 End queue run: pid=25916
2017-04-04 22:17:32 failed to expand condition "${if exists {$home/etc/$domain/quota}{${if > {${lookup{$local_part}lsearch{$home/etc/$domain/quota}{$value}{0}}}{0}{${if match {${readsocket{/var/run/dovecot/quota-status}{request=smtpd_access_policy
recipient=${quote:$local_part}@${quote:$domain}
size=$message_size

---------------------------------------------------------------------

I would be most grateful if someone could give me a pointer to where to look to solve this issue...

Wendy

 

[cPanelMichael]

Hello,

Could you verify if the "WHM >> Email >> Greylisting" feature is enabled on this system?

2017-04-04 22:17:32 failed to expand condition "${if exists {$home/etc/$domain/quota}{${if > {${lookup{$local_part}lsearch{$home/etc/$domain/quota}{$value}{0}}}{0}{${if match {${readsocket{/var/run/dovecot/quota-status}{request=smtpd_access_policy

This shouldn't result in email delivery issues, but here's the thread where the solution to this issue is discussed:

SOLVED - virtual_user_overquota error

Thank you.

 

[WendyTinley]

Hello,

Could you verify if the "WHM >> Email >> Greylisting" feature is enabled on this system?



This shouldn't result in email delivery issues, but here's the thread where the solution to this issue is discussed:

SOLVED - virtual_user_overquota error

Thank you.

Hi thanks for your reply;

Greylisting
Greylisting defends email users against spam. When enabled, the mail server will temporarily reject any email from a sender the server does not recognize. If the email is legitimate, the originating server will try again after a delay. After sufficient time has elapsed, the server will accept the email.



Greylisting is Disabled

 

[cPanelMichael]

Hello,

I don't see anything else on the cPanel server that would be resulting in the delay, however feel free to open a support ticket using the link in my signature if you'd like us to take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.