Skip to main content

CPANEL-35877 - condition check lookup defer

Comments

35 comments

  • sparek-3
    Seems to be another Exim 4.94 "issue". Starting to wonder if they pushed out Exim 4.94 out too soon. There's mentioning of it in the Exim mailing list from around April 30th. Although no resolution and not really a lot of discussion. They do seem to believe it's something in the RCPT ACL - which I do have some customizations in there. So it'd be helpful to know if other plain-jane cPanel users are seeing this in their logs, if they're not, then it may be something in my customizations. But as they allude to on the mailing list, the issue is difficult to replicate.
    0
  • cPRex Jurassic Moderator
    Hey there! This is a known issue that is being worked on right now through case CPANEL-35877. When this happens, you can restart the dovecot service to get things working again temporarily. We plan to have fixes for versions 94, 96, and 98 in place when this is resolved, but I'll be sure to update this thread with more details as I get them.
    0
  • vmrejas
    Hi, is maybe there workaround, i have this problem every 2 days, and i need to restart entire server to get work again.
    0
  • cPRex Jurassic Moderator
    @vmrejas - the only workaround at this time is to restart the Dovecot service. I don't have any other updates from the developers at this point.
    0
  • danielfm
    Hello! I have the same problem. Are there any updates on this?
    0
  • cPRex Jurassic Moderator
    I don't have any additional updates at this time. I do know this is fixed in version 98, but there haven't been any backports to other versions applied just yet.
    0
  • jarland
    This is simply unacceptable. Since last log rotations this error has occurred 6,894 times on one of my servers due to this bug. Fortunately for cPanel, this is generating less complaints than migration to DirectAdmin. However, it's no small thing to note that this is threatening to continue for an entire quarter or more with no fix in sight. This is happening on live servers. Albeit to such a degree that many customers probably just retry sending mail and don't think about it again, but that is the only detail standing between this and the complete fall of cPanel. I'm not being dramatic. This is a software bug. There is no correlation with quota or Dovecot restarts, the correlation there appears to merely be correlation with the randomness of the behavior to begin with. The continual price increases preceded a software bug that has it's fix thrown far into the future, at an unknown date. This is part of the core of cPanel and it's broken. How can anything be happening at cPanel other than all hands on deck to repair the broken software?
    0
  • cPRex Jurassic Moderator
    I'm sorry you've run into this issue! cPanel 98 is already in the Edge tier, so it's not "far" into the future, but the next major release. I also see the developers are discussing backport options to 94 and 96, but I don't have details on when or if those will happen, or if it will only be included in version 98. As for fixing issues, we definitely try and get to them all, but we also consider the number of users affected and how much development work a certain fix will take when prioritizing this. But, as I mentioned, this is already fixed and included in the next major release, as soon as that gets to a stable verison.
    0
  • cPRex Jurassic Moderator
    Update - this is officially included in 98.0.0, so it will be in the first release of version 98 coming out soon!
    0
  • cPRex Jurassic Moderator
    Update - the team is working on getting this backported to version 96. We are expecting this to be included in 96.0.14, which should be the next major release.
    0
  • cPRex Jurassic Moderator
    Update - this has been backported to 96.0.14.
    0
  • jarland
    @cPRex We're still seeing the same behavior without change after upgrading to 96.0.14 on multiple servers.
    0
  • cPRex Jurassic Moderator
    @jarland - could you submit a ticket to our team so we can check it out?
    0
  • jarland
    Roger, opened #94350545.
    0
  • cPRex Jurassic Moderator
    Thanks for doing that - I'm following along with that on my end now as well.
    0
  • cPRex Jurassic Moderator
    Our team checked the system and wasn't able to find errors happening after the update to 96.0.14. If you have additional details you can provide in the ticket on recent errors please let us know!
    0
  • Alfredo Diaz
    Our team checked the system and wasn't able to find errors happening after the update to 96.0.14. If you have additional details you can provide in the ticket on recent errors please let us know!

    This is not solved. It's still happening.
    0
  • cPRex Jurassic Moderator
    @Alfredo Diaz - could you please submit a ticket to our support team? While we've had a few reports of this still happening, we haven't been able to reproduce this on our side, so we'd need to see it in action on an affected system. If you are able to submit a ticket, please post the number here so I can follow along and make sure this thread stays updated.
    0
  • chalupa
    I'm seeing the same thing with a customer's server but restarting Dovecot hasn't done anything to help this issue. Anyone 2023-04-10 18:16:43 H=mail-ot1-f48.google.com [209.85.210.48]:39659 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= temporarily rejected RCPT : condition check lookup defer 2023-04-10 18:17:11 H=mail-pf1-f196.google.com [209.85.210.196]:55800 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= temporarily rejected RCPT : condition check lookup defer 2023-04-10 18:17:11 H=mail-pg1-f171.google.com [209.85.215.171]:54313 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= temporarily rejected RCPT : condition check lookup defer 2023-04-10 18:17:41 H=mail-yw1-f173.google.com [209.85.128.173]:33571 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= temporarily rejected RCPT gmail.com@domain.tld>: condition check lookup defer Anyone else seeing similar issues?
    0
  • cPRex Jurassic Moderator
    @chalupa - are you on cPanel 108 or 110? There haven't been many recent reports of this issue, so I just wanted to confirm you are running a modern cPanel version.
    0
  • chalupa
    @chalupa - are you on cPanel 108 or 110? There haven't been many recent reports of this issue, so I just wanted to confirm you are running a modern cPanel version.

    cat /usr/local/cpanel/version 11.108.0.15 We've noticed something else that may be causing an issue exim 4990 mailnull 10u IPv4 2524815 0t0 TCP host.domain.tld:smtp->a230-5.mailgun.net:15383 (ESTABLISHED) exim 4990 mailnull 12u IPv4 2524815 0t0 TCP host.domain.tld:smtp->a230-5.mailgun.net:15383 (ESTABLISHED) exim 4992 mailnull 10u IPv4 2524823 0t0 TCP host.domain.tld:smtp->mail-bmxind01hn2206.outbound.protection.outlook.com:10885 (ESTABLISHED) exim 4992 mailnull 12u IPv4 2524823 0t0 TCP host.domain.tld:smtp->mail-bmxind01hn2206.outbound.protection.outlook.com:10885 (ESTABLISHED) A ton of outbound connections to 200 mail servers. We're suspecting possibly a compromised server actually.
    0
  • cPRex Jurassic Moderator
    That would definitely indicate an issue. Let us know if you need anything else from our end.
    0
  • VincentM
    I am getting the same error and I am running on cPanel version 112.0.3. This error occurs to emails being sent to my domain emails. The error is condition check lookup defer
    0
  • cPRex Jurassic Moderator
    @VincentM - can you post the mail log with the personal details obscured for security?
    0
  • VincentM
    How can I retrieve the mail log
    0
  • cPRex Jurassic Moderator
    The full entry for the mail transaction would be inside /var/log/exim_mainlog. I'd just search that log for the mail ID and you'll find it. This does require root access to the system.
    0
  • VincentM
    Below is the log 2023-06-29 23:06:07 SMTP connection from rntft65.rnmk.com [147.154.148.137]:55010 closed by QUIT 2023-06-29 23:06:15 SMTP connection from [57.128.141.236]:37544 (TCP/IP connection count = 1) 2023-06-29 23:06:23 SMTP connection from [209.85.210.46]:53577 (TCP/IP connection count = 2) 2023-06-29 23:06:43 SMTP connection from [127.0.0.1]:53962 (TCP/IP connection count = 3) 2023-06-29 23:06:43 SMTP connection from (localhost) [127.0.0.1]:53962 closed by QUIT X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes C="250 2.0.0 OK 1688069227 l3-20020a05622a174300b00401fa32358dsi4733760qtk.193 - gsmtp" 2023-06-29 23:07:07 1qExv0-00EE6r-13 Completed 2023-06-29 23:07:26 H=ns31642101.ip-57-128-141.eu [57.128.141.236]:37544 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=noF=<> temporarily rejected RCPT >: condition check lookup defer 2023-06-29 23:07:26 SMTP connection from ns31642101.ip-57-128-141.eu [57.128.141.236]:37544 closed by QUIT 2023-06-29 23:07:34 H=mail-ot1-f46.google.com [209.85.210.46]:53577 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 CV=no F=<> temporarily rejected RCPT : condition check lookup defer 2023-06-29 23:07:34 SMTP connection from mail-ot1-f46.google.com [209.85.210.46]:53577 closed by QUIT 2023-06-29 23:08:04 SMTP connection from [52.128.33.129]:33382 (TCP/IP connection count = 1) 2023-06-29 23:09:14 H=mail-33-129.rch002.net [52.128.33.129]:33382 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= temporarily rejected RCPT : condition check lookup defer 2023-06-29 23:09:14 SMTP connection from mail-33-129.rch002.net [52.128.33.129]:33382 closed by QUIT 2023-06-29 23:09:30 SMTP connection from [162.144.242.3]:46434 (TCP/IP connection count = 1)
    0
  • cPRex Jurassic Moderator
    @VincentM - does this happen with other addresses outside of Gmail?
    0
  • VincentM
    @VincentM - does this happen with other addresses outside of Gmail?

    This happens to all emails sent to the domain on this server
    0
  • cPRex Jurassic Moderator
    Could you create a support ticket so we can take a look? It certainly sounds like that same cause, but I don't have any other recent reports of this happening.
    0

Please sign in to leave a comment.