Skip to main content

Wrong sender user in Mail Delivery Reports

rs200
Hi, recently i've noticed a strange thing in the WHM of my VPS. In the "Mail Delivery Reports" of the "View Sent Summary" there are some email accounts that send email as remote users instead of the associate user. The associate domain was created on the VPS and name servers and MX records point to the VPS IP. The domain has about 30 email accounts and only two of them look sending email as remote user, all the others have the associate user as the "Sender User". I can't explain this. I attach an image with the Delivery Event Details (without sensitive data). What's wrong with that?

Comments

8 comments

Date Votes
  • cPanelMichael
    Hello @rs200, The "-remote-" sender indicates the email was delivered through the local server by a sender or recipient on a remote server. To get a better idea of the source of an email, you search for the message ID in /var/log/exim_mainlog. EX: exigrep MSGID /var/log/exim_mainlog
    Thank you.
    0
  • rs200
    Hello @rs200, The "-remote-" sender indicates the email was delivered through the local server by a sender or recipient on a remote server. To get a better idea of the source of an email, you search for the message ID in /var/log/exim_mainlog. EX: exigrep MSGID /var/log/exim_mainlog
    Thank you.

    Thank you for your reply Michael. I am a bit confusing about this, the sender use a PC with a client mail (Thunderbird) for send emails. In the headers i see this Received-SPF: softfail (xxxxxx.it: domain xxxx.it does not designate XX.XX.XXX.XXX as permitted sender)
    I can't still get why this account is in the table of "Mail Delivery Reports" like -remote- and not like the associate user. There is always a Sender Identification for all other accounts, except for this, and all are part of the same domain account. It depends on by ISP used?
    0
  • cPanelMichael
    I can't still get why this account is in the table of "Mail Delivery Reports" like -remote- and not like the associate user.

    Can you let us know the output from /var/log/exim_mainlog for that particular message? EX: exigrep SUBJECT /var/log/exim_mainlog
    Replace "SUBJECT" with the subject of the message. Thank you.
    0
  • rs200
    Can you let us know the output from /var/log/exim_mainlog for that particular message? EX: exigrep SUBJECT /var/log/exim_mainlog
    Replace "SUBJECT" with the subject of the message. Thank you.

    Sure, this is the output from one of the messages. I replace the real domain and real emails, both user1 and user2 are on VPS but user1 appeared as -remote- in the report. 2018-09-18 10:33:04 1g2BRH-0004HB-34 H=mr012msb.fastweb.it [85.18.95.109]:42312 Warning: "SpamAssassin as user detected message as NOT spam (2.2)" 2018-09-18 10:33:04 1g2BRH-0004HB-34 H=mr012msb.fastweb.it [85.18.95.109]:42312 Warning: Message has been scanned: no virus or other harmful content was found 2018-09-18 10:33:04 1g2BRH-0004HB-34 <= user1@domain.it H=mr012msb.fastweb.it [85.18.95.109]:42312 P=esmtp S=101773 id=6143562f-4967-f92b-fd59-b8e50ee4262f@domain.it T="ACCREDITO DA ADECCO" for user2@domain.it 2018-09-18 10:33:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1g2BRH-0004HB-34 2018-09-18 10:33:04 1g2BRH-0004HB-34 => user2 R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 AGpLNkC4oFtEQAAAeuAD1Q Saved" 2018-09-18 10:33:04 1g2BRH-0004HB-34 Completed
    0
  • cPanelMichael
    Hello @rs200, Could you open a WHM >> Mail Delivery Reports? You can post the ticket number here and we will link this thread to it. Thank you.
    0
  • rs200
    Hello @rs200, Could you open a support ticket so we can take a closer look at the system and determine why that message is marked as "-remote-" in WHM >> Mail Delivery Reports? You can post the ticket number here and we will link this thread to it. Thank you.

    Hi Michael, i have to use the "Create Support Ticket" functionality of WHM and follow the wizard?
    0
  • cPanelMichael
    i have to use the "Create Support Ticket" functionality of WHM and follow the wizard?

    Hello @rs200, Yes, or follow the instructions on the link below:
    0
  • rs200
    Hello @rs200, Yes, or follow the instructions on the link below:
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post