Mails are not being delivered and are in queue manager

[amrit_singh]

Hi, Can someone please help me with the below query? I am not receiving alert emails from WHM and they are getting frozen in the queue manager. Below is the error message I checked in the queue manager.

Please note here my email is being sent from a third party and not from cPanel.

Any help will be highly appreciated.


--1671364171-eximdsn-116040087
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]******.co.in
all hosts for '*******.co.in' have been failing for a long time (and retry time not reached)

--1671364171-eximdsn-116040087
Content-type: message/delivery-status

Reporting-MTA: dns; server.******.com

Action: failed
Final-Recipient: rfc822;[email protected]******.co.in
Status: 5.0.0

--1671364171-eximdsn-116040087
Content-type: message/rfc822

Return-path: <[email protected]*****.com>
Received: from root by server.******.com with local (Exim 4.95)
(envelope-from <[email protected]*****.com>)
id 1p6sAd-0004q9-Ix
for [email protected]*****.co.in;
Sun, 18 Dec 2022 17:19:31 +0530
From: [email protected]****.com
To: [email protected]*****.co.in
Subject: lfd on server.*****.com: blocked 181.78.3.12 (CO/Colombia/12.3.78.181.ufinet.com.co)
Message-Id: <[email protected]****.com>
Date: Sun, 18 Dec 2022 17:19:31 +0530

Time: Sun Dec 18 17:19:31 2022 +0530
IP: 181.78.3.12 (CO/Colombia/12.3.78.181.ufinet.com.co)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked: Permanent Block [LF_SSHD]

Log entries:

Dec 18 17:14:20 server sshd[18208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.78.3.12 user=root
Dec 18 17:14:22 server sshd[18208]: Failed password for root from 181.78.3.12 port 40940 ssh2
Dec 18 17:17:56 server sshd[18286]: Invalid user riad from 181.78.3.12 port 58138
Dec 18 17:17:58 server sshd[18286]: Failed password for invalid user riad from 181.78.3.12 port 58138 ssh2
Dec 18 17:19:27 server sshd[18547]: Invalid user elastic from 181.78.3.12 port 60674


--1671364171-eximdsn-116040087--

 

[cPRex]

Hey there! The most important part of the error message is this:

 all hosts for '*******.co.in' have been failing for a long time (and retry time not reached)

Can you try running the following command to check the mail delivery record from your server to that address?

dig mx *******.co.in

If that returns what you expect, can you then run this command?

telnet <result from above dig command) 25

That would show if you can connect to the mailserver for *******.co.in from your server.

 

[amrit_singh]

Hi,

While running dig command i got below result

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.10 <<>> mx xxxx.co.in
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33034
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;xxxxxxxx.co.in. IN MX

;; ANSWER SECTION:
xxxxxx.co.in. 881 IN MX 50 mx3.zoho.in.
xxxxxx.co.in. 881 IN MX 20 mx2.zoho.in.
xxxxxx.co.in. 881 IN MX 10 mx.zoho.in.

;; Query time: 0 msec
;; SERVER: 172.31.0.2#53(172.31.0.2)
;; WHEN: Sun Jan 22 12:47:12 IST 2023
;; MSG SIZE rcvd: 109


and when i did telnet i received
Trying 116.206.105.72...
Connected to xxxxxx.co.in.
Escape character is '^]'.
220-cp-in-17.webhostbox.net ESMTP Exim 4.95 #2 Sun, 22 Jan 2023 07:17:38 +0000
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail

Also when mails get in Queue and i click on deliver now button i received below error.

LOG: MAIN
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1pJTsV-0003u1-Ba
delivering 1pJTsV-0003u1-Ba
LOG: MAIN
Sender identification U=__cpanel__service__auth__icontact__t5vbqovupclle_7h D=-system- S=__cpanel__service__auth__icontact__t5vbqovupclle_7h
Connecting to mx.zoho.in [169.148.146.168]:25 ... connected
SMTP<< 220 mx.zoho.in SMTP Server ready January 22, 2023 12:51:27 PM IST
SMTP>> EHLO server.xxxxxx.com
SMTP<< 250-mx.zoho.in Hello server.xxxxx.com (server.xxxx.com (xx.xxx.xxx..xxx))
250-STARTTLS
250-8BITMIME
250 SIZE 53477376
SMTP>> STARTTLS
SMTP<< 220 Ready to start TLS.
SMTP>> EHLO server.xxxx.com
SMTP<< 250-mx.zoho.in Hello server.xxxx.com (server.xxxx.com (xx.xxx.xxx.xxx))
250-8BITMIME
250 SIZE 53477376
SMTP>> MAIL FROM:<[email protected]> SIZE=45259
SMTP<< 250 Sender <[email protected]> OK
SMTP>> RCPT TO:<[email protected]>
SMTP<< 451 4.7.1 Greylisted, try again after some time
LOG: MAIN
H=mx.zoho.in [169.148.146.168]: SMTP error from remote mail server after RCPT TO:<[email protected]>: 451 4.7.1 Greylisted, try again after some time
SMTP+> QUIT
SMTP(TLS shutdown)>>
SMTP(shutdown)>>
SMTP(closed)<<
SMTP(close)>>
Connecting to mx.zoho.in [169.148.149.118]:25 ... connected
SMTP<< 220 mx.zoho.in SMTP Server ready January 22, 2023 12:51:28 PM IST
SMTP>> EHLO server.xxxx.com
SMTP<< 250-mx.zoho.in Hello server.xxxx.com (server.xxxx.com (xx.xx.xx.xxx.))
250-STARTTLS
250-8BITMIME
250 SIZE 53477376
SMTP>> STARTTLS
SMTP<< 220 Ready to start TLS.
SMTP>> EHLO server.xxxx.com
SMTP<< 250-mx.zoho.in Hello server.xxxxxxx.com (server.xxxx.com (xx.xx.xxx.xxx))
250-8BITMIME
250 SIZE 53477376
SMTP>> MAIL FROM:<[email protected]> SIZE=45259
SMTP<< 250 Sender <[email protected]> OK
SMTP>> RCPT TO:<[email protected]>
SMTP<< 451 4.7.1 Greylisted, try again after some time
SMTP+> QUIT
SMTP(TLS shutdown)>>
SMTP(shutdown)>>
SMTP(closed)<<
SMTP(close)>>
LOG: MAIN
== [email protected] R=dkim_lookuphost T=dkim_remote_smtp defer (-44) H=mx.zoho.in [169.148.149.118]: SMTP error from remote mail server after RCPT TO:<[email protected]>: 451 4.7.1 Greylisted, try again after some time

 

[cPRex]

Thanks for that output - it seems the remote mailserver has Greylisting enabled:

Greylisting | cPanel & WHM Documentation

This interface allows you to configure Greylisting, a service that protects your server against unwanted email or spam.

docs.cpanel.net

This means that your initial connection will always fail, but then you will be successful in a later attempt. This does seem different than your earlier "retry time not reached" error, but indicates things are now delivering properly.

 

[amrit_singh]

Mails are delivering fine to gmail but not on zoho server that must be due to zoho server end settings. Anyways my purpose is solved.
Thank you very much for the support.