Missing inbound emails

[Filipe Martins]

I have a client that is not receiving some emails. At least one of them I located on exim's log (/var/log/exim_mainlog):

2021-06-01 16:26:13 1lo6HU-0003T1-I7 <= [email protected] H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 P=esmtp S=31789 id=PELFORTH8QhzMa [email protected] T="Commande 100154158 du 01/06/2021 BUISSE / PERSEGOL THIBAULT Du 29/05/2021 N\260 108800171 BP N\260 35714/7" from <ma [email protected]> for [email protected]

2021-06-01 16:26:13 1lo6HU-0003T1-I7 => theuser+spam <[email protected]> F=<[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> 6Eh+MpVRtmDzMwAAknWyVA Saved"

Does anyone know what's up with the second entry? I don't have any custom spam filter installed.

Thanks.

 

[iminlovewith1952]

Have you tried sending a ticket to one of the administrators here?

 

[cPRex]

Is that the complete output for the email? If you run

grep 1lo6HU-0003T1-I7 /var/log/exim_mainlog

do you see any additional lines for that message?

 

[Filipe Martins]

Hello to all.
No, I haven't opened a ticket yet. I hoped this to be something minor (although I never encountered it before).

These are all the entries in the log for this message:

2021-06-01 16:26:13 1lo6HU-0003T1-I7 H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 Warning: "SpamAssassin as mydomainuser detected message as spam (5.2)"

2021-06-01 16:26:13 1lo6HU-0003T1-I7 H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 Warning: Message has been scanned: no virus or other harmful content was found

2021-06-01 16:26:13 1lo6HU-0003T1-I7 <= [email protected] H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 P=esmtp S=31789 id=[email protected] T="Commande 100154158 du 01/06/2021 BUISSE / PERSEGOL THIBAULT Du 29/05/2021 N\260 108800171 BP N\260 35714/7" from <[email protected]> for [email protected]

2021-06-01 16:26:13 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1lo6HU-0003T1-I7

2021-06-01 16:26:13 1lo6HU-0003T1-I7 => theuser+spam <[email protected]> F=<[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> 6Eh+MpVRtmDzMwAAknWyVA Saved"

2021-06-01 16:26:13 1lo6HU-0003T1-I7 Completed


Thanks.

 

[cPRex]

Thanks for that - that seems to indicate the message got moved to a spam box or other spam filter, but it definitely is reaching the server. Does that user have a mail client like Outlook or Thunderbird that might be processing the spam differently? That could connect and handle the message before they even see it.

Other than that, it looks like things are working normally on the server-side.

 

[Filipe Martins]

cPRex, the client uses MS Exchange and I'm looking if it could be it.

Strangely enough, I disabled "SpamTrap" in WHM and I stopped getting entries like those, although it wasn't enabled for the client's account.

I'm waiting to see if the problem happens again.