Wrong sender user in Mail Delivery Reports

rs200

Active Member
Dec 4, 2017
40
9
8
Italy
cPanel Access Level
Root Administrator
Hi,

recently i've noticed a strange thing in the WHM of my VPS.

In the "Mail Delivery Reports" of the "View Sent Summary" there are some email accounts that send email as remote users instead of the associate user.

The associate domain was created on the VPS and name servers and MX records point to the VPS IP.

The domain has about 30 email accounts and only two of them look sending email as remote user, all the others have the associate user as the "Sender User".

I can't explain this. I attach an image with the Delivery Event Details (without sensitive data).

What's wrong with that?
 

Attachments

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463
Hello @rs200,

The "-remote-" sender indicates the email was delivered through the local server by a sender or recipient on a remote server. To get a better idea of the source of an email, you search for the message ID in /var/log/exim_mainlog. EX:

Code:
exigrep MSGID /var/log/exim_mainlog
Thank you.
 

rs200

Active Member
Dec 4, 2017
40
9
8
Italy
cPanel Access Level
Root Administrator
Hello @rs200,

The "-remote-" sender indicates the email was delivered through the local server by a sender or recipient on a remote server. To get a better idea of the source of an email, you search for the message ID in /var/log/exim_mainlog. EX:

Code:
exigrep MSGID /var/log/exim_mainlog
Thank you.
Thank you for your reply Michael.

I am a bit confusing about this, the sender use a PC with a client mail (Thunderbird) for send emails.

In the headers i see this

Code:
Received-SPF: softfail (xxxxxx.it: domain xxxx.it does not designate XX.XX.XXX.XXX as permitted sender)
I can't still get why this account is in the table of "Mail Delivery Reports" like -remote- and not like the associate user.

There is always a Sender Identification for all other accounts, except for this, and all are part of the same domain account.

It depends on by ISP used?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463
I can't still get why this account is in the table of "Mail Delivery Reports" like -remote- and not like the associate user.
Can you let us know the output from /var/log/exim_mainlog for that particular message? EX:

Code:
exigrep SUBJECT /var/log/exim_mainlog
Replace "SUBJECT" with the subject of the message.

Thank you.
 

rs200

Active Member
Dec 4, 2017
40
9
8
Italy
cPanel Access Level
Root Administrator
Can you let us know the output from /var/log/exim_mainlog for that particular message? EX:

Code:
exigrep SUBJECT /var/log/exim_mainlog
Replace "SUBJECT" with the subject of the message.

Thank you.
Sure, this is the output from one of the messages.

I replace the real domain and real emails, both user1 and user2 are on VPS but user1 appeared as -remote- in the report.

Code:
2018-09-18 10:33:04 1g2BRH-0004HB-34 H=mr012msb.fastweb.it [85.18.95.109]:42312 Warning: "SpamAssassin as user detected message as NOT spam (2.2)"
2018-09-18 10:33:04 1g2BRH-0004HB-34 H=mr012msb.fastweb.it [85.18.95.109]:42312 Warning: Message has been scanned: no virus or other harmful content was found
2018-09-18 10:33:04 1g2BRH-0004HB-34 <= [email protected] H=mr012msb.fastweb.it [85.18.95.109]:42312 P=esmtp S=101773 [email protected] T="ACCREDITO DA ADECCO" for [email protected]
2018-09-18 10:33:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1g2BRH-0004HB-34
2018-09-18 10:33:04 1g2BRH-0004HB-34 => user2 <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> AGpLNkC4oFtEQAAAeuAD1Q Saved"
2018-09-18 10:33:04 1g2BRH-0004HB-34 Completed
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463
Hello @rs200,

Could you open a support ticket so we can take a closer look at the system and determine why that message is marked as "-remote-" in WHM >> Mail Delivery Reports? You can post the ticket number here and we will link this thread to it.

Thank you.
 
Last edited:

rs200

Active Member
Dec 4, 2017
40
9
8
Italy
cPanel Access Level
Root Administrator
Hello @rs200,

Could you open a support ticket so we can take a closer look at the system and determine why that message is marked as "-remote-" in WHM >> Mail Delivery Reports? You can post the ticket number here and we will link this thread to it.

Thank you.
Hi Michael,

i have to use the "Create Support Ticket" functionality of WHM and follow the wizard?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463

rs200

Active Member
Dec 4, 2017
40
9
8
Italy
cPanel Access Level
Root Administrator
  • Like
Reactions: cPanelMichael