How-to track a message sent to a mailing list

Introduction

Sometimes users send messages to mailing lists, and the message gets "lost".  This article discusses how to find out what happened to the message.  You must be root to access the files and folders discussed in this article.  This article does assume some existing knowledge of command line Linux administration.

Procedure

1. Find the message in the Exim log at /var/log/exim_mainlog. 

The easiest way to do this is to use grep for the values that you know.  For instance, if you know the user who sent the message, and the mailing list they sent it to, you can do the following search:

grep sender@somedomain.tld /var/log/exim_mainlog | grep list@mydomain.tld | tail

In the output you will see something like this:

id=1598252431.j70vPATnUD9yOPtF@mailserver.test

This is the message ID.  It is different from the Exim ID that you usually use when searching for messages and it may be longer or shorter, contain special characters, or otherwise be different from the example above (taken from a test server).

2. Find the message in the mailman logs at /usr/local/cpanel/3rdparty/mailman/logs.

Since message IDs can contain special characters, you may need to escape them with a backslash (\) character in order to search the logs for them.  For instance, this message ID has the special character $ in it twice, in addition to the @ sign.

012d01D34ab0$564c7b50$3bdf71f0@mailserver.test

In most cases, you can simply grep for part of the message ID.  In this case, I selected the characters before the first special character, like this:

grep 012d01D34ab0 /usr/local/cpanel/3rdparty/mailman/logs/*

But if there are a lot of special characters, or you can't narrow down the results that way, you may need to use an escape like this:

grep 012d01D34ab0\$564c7b50\$3bdf71f0\@mailserver.test /usr/local/cpanel/3rdparty/mailman/logs/*

3. Check the log for more information

One thing you might find is "message discarded" in the vette log:

/usr/local/cpanel/3rdparty/mailman/logs/vette: DATE (PID123) Message discarded, msgid: <012d01D34ab0$564c7b50$3bdf71f0@mailserver.test>'

You can then open the vette log with less and search for the message ID inside the log.  (See the less manual page if you need more information on how to search inside less.)  You might find something like this:

DATE (PID123) List: DMARC lookup for sender@mailserver.test (_dmarc.mailserver.test) found p=reject in _dmarc.mailserver.test. = v=DMARC1;p=reject;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400

DATE (PID123) Message discarded, msgid: <012d01D34ab0$564c7b50$3bdf71f0@mailserver.test>'
        list: List,
        handler: SpamDetect

This tells us that the SpamDetect function of Mailman determined that the message was spam because the DMARC policy for the domain is to reject any messages that don't come from the proper servers with the proper signatures.  Since Mailman can't meet that qualification, it doesn't send the message at all. 

You can change this behavior in the Mailman List management interface under Privacy » Sender Filters. You're looking for the option "Action to take when anyone posts to the list from a domain with a DMARC Reject/Quarantine Policy."  With the above message, it's currently set to "discard", but if you want the message sent anyway, you can select one of the other options.