Sep 29, 2016
12
2
3
Portugal
cPanel Access Level
Root Administrator
I have a client that is not receiving some emails. At least one of them I located on exim's log (/var/log/exim_mainlog):

2021-06-01 16:26:13 1lo6HU-0003T1-I7 <= [email protected] H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 P=esmtp S=31789 id=PELFORTH8QhzMa [email protected] T="Commande 100154158 du 01/06/2021 BUISSE / PERSEGOL THIBAULT Du 29/05/2021 N\260 108800171 BP N\260 35714/7" from <ma [email protected]> for [email protected]

2021-06-01 16:26:13 1lo6HU-0003T1-I7 => theuser+spam <[email protected]> F=<[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> 6Eh+MpVRtmDzMwAAknWyVA Saved"

Does anyone know what's up with the second entry? I don't have any custom spam filter installed.

Thanks.
 
Last edited by a moderator:
Sep 29, 2016
12
2
3
Portugal
cPanel Access Level
Root Administrator
Hello to all.
No, I haven't opened a ticket yet. I hoped this to be something minor (although I never encountered it before).

These are all the entries in the log for this message:

2021-06-01 16:26:13 1lo6HU-0003T1-I7 H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 Warning: "SpamAssassin as mydomainuser detected message as spam (5.2)"

2021-06-01 16:26:13 1lo6HU-0003T1-I7 H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 Warning: Message has been scanned: no virus or other harmful content was found

2021-06-01 16:26:13 1lo6HU-0003T1-I7 <= [email protected] H=mta-global.felixapps.com [62.244.93.200]:57081 I=[77.91.206.217]:25 P=esmtp S=31789 id=[email protected] T="Commande 100154158 du 01/06/2021 BUISSE / PERSEGOL THIBAULT Du 29/05/2021 N\260 108800171 BP N\260 35714/7" from <[email protected]> for [email protected]

2021-06-01 16:26:13 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1lo6HU-0003T1-I7

2021-06-01 16:26:13 1lo6HU-0003T1-I7 => theuser+spam <[email protected]> F=<[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> 6Eh+MpVRtmDzMwAAknWyVA Saved"

2021-06-01 16:26:13 1lo6HU-0003T1-I7 Completed


Thanks.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,421
1,001
313
cPanel Access Level
Root Administrator
Thanks for that - that seems to indicate the message got moved to a spam box or other spam filter, but it definitely is reaching the server. Does that user have a mail client like Outlook or Thunderbird that might be processing the spam differently? That could connect and handle the message before they even see it.

Other than that, it looks like things are working normally on the server-side.
 
Sep 29, 2016
12
2
3
Portugal
cPanel Access Level
Root Administrator
cPRex, the client uses MS Exchange and I'm looking if it could be it.

Strangely enough, I disabled "SpamTrap" in WHM and I stopped getting entries like those, although it wasn't enabled for the client's account.

I'm waiting to see if the problem happens again.
 
  • Like
Reactions: cPRex