Skip to main content

exim sending failure and not rejection

keat63
I have a thread open which eventually evolves in to this question, but feel that this question really deserves a thread in it's own right. So I have a mailbox which has never existed zzzzzzzzzzzzzzzzzzzzzz@mydomain.com If I send to this email, exim rejects the mail at smtp time. (expected) I have another mailbox cpanel@mydomain.com that maybe used to exist. exim doesn't reject, but accepts then sends a failure, same result ultimately, but not quite how it ought to work. There are no forwarders or filters that I can see. I've checked home/user/mail and see no mailbox. also home/user/mail/domain and see nothing. I've also checked etc/valiases/user and see no entries in there either. I have CSF explorer installed, if i search 'files, folders and words' for 'cpanel@', nothing is returned. If I search for 'somerealuser@', then all sorts of entries are returned. If Cpanel@ used to exist (which I strongly suspect it did), then something somewhere has been left behind, when the account was removed. so have I missed anything ?

Comments

16 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey hey! A grep through all of /home/username for the full email address would show if there were any trace of that, but I haven't heard of this exact behavior before. Would you be able to post a log of the "accept then fail" scenario so I can try and reproduce on my end?
    0
  • sparek-3
    Does [font="courier new">/home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com/cpanel exist? This is a somewhat known issue. I think it happened after cPanel switched to using Dovecot for LMTP. The cPanel end-user interface still looks in [font="courier new">/home/$(/scripts/whoowns mydomain.com)/etc/mydomain.com/passwd to determine if an email account exists. But Exim uses the existence of a directory under [font="courier new">/home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com/ to determine if an email account exists. The two get out of sync some how. So cPanel will tell you that [plain]cpanel@mydomain.com[/plain] doesn't exist, but if a directory exists at [font="courier new">/home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com/cpanel then Exim will accept the email as a real email account.
    0
  • keat63
    struggling to locate this location. /home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com Maybe I'm misreading something ?
    0
  • sparek-3
    Actually you already checked this, according to your original post. [font="courier new">/home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com/cpanel is just a fancy way of checking [font="courier new">/home/%userthatownsmydomain.com%/mail/mydomain.com/cpanel but giving it within the context of only knowing [font="courier new">mydomain.com. It's kind of like using order of operations with parenthesis in math. When the command is run the command - [font="courier new">/scripts/whoowns mydomain.com will run first - which on a cPanel system will return the username that owns mydomain.com. That username fits into the placement of [font="courier new">$(/scripts/whoowns mydomain.com) and then the rest of the string is returned as given. [font="courier new">ls -ald /home/$(/scripts/whoowns mydomain.com)/mail/mydomain.com/cpanel is the same thing as [font="courier new">ls -ald /home/%userthatownsmydomain.com%/mail/mydomain.com/cpanel but without knowing the username or multiple variables, you're deriving the username or other variables from a known variable - mydomain.com. You probably need to be using bash as your shell - but that's typically default on CentOS and CentOS based distributions and pretty much any large distribution or distribution that cPanel supports.
    0
  • keat63
    I don't really want to raise a ticket on such a trivial matter, so any other ideas would be welcomed.
    0
  • keat63
    So here's the bounce i get back when sending from gmail: This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: cpanel@mydomain.com No such person at this address." This is what exim says: 2022-06-13 18:36:53 1o0nzi-00072v-2T <= gmailaccount@gmail.com H=mail-qv1-f52.google.com [209.85.219.52]:40701 P=esmtps X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no S=2623 id=CAEHC+xnEEVxwZvsmVbY=bfisVMomvrqgvEHXU=PSeCUeY2OBkg@mail.gmail.com T="this is a test" for cpanel@mydomain.com 2022-06-13 18:36:55 cwd=/var/spool/exim/input 5 args: /usr/sbin/exim -C /etc/exim_outgoing.conf -Mc 1o0nzi-00072v-2T 2022-06-13 18:36:55 1o0nzi-00072v-2T ** cpanel@mydomain.com R=virtual_aliases: No such person at this address." 2022-06-13 18:36:55 cwd=/var/spool/exim 9 args: /usr/sbin/exim -C /etc/exim_outgoing.conf -t -oem -oi -f <> -E1o0nzi-00072v-2T 2022-06-13 18:36:55 1o0nzj-00074b-F6 <= <> R=1o0nzi-00072v-2T U=mailnull P=local S=4456 T="Mail delivery failed: returning message to sender" for gmailaccount@gmail.com 2022-06-13 18:36:55 1o0nzi-00072v-2T Completed and the same test to an address which I just made up and never existed: 2022-06-13 18:41:30 SMTP connection from [209.85.222.182]:34745 (TCP/IP connection count = 1) 2022-06-13 18:42:11 H=mail-qk1-f182.google.com [209.85.222.182]:34745 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= rejected RCPT : No such person at this address." 2022-06-13 18:42:42 SMTP connection from mail-qk1-f182.google.com [209.85.222.182]:34745 closed by QUIT
    0
  • sparek-3
    I was able to find an instance of this happening on one of our servers - not cpanel@, it was a different email address. Investigating this found that the email address mentioned in the logs (i.e. [font="courier new">[plain]cpanel@mydomain.com[/plain]) was set up as a forwarder, it exists in [font="courier new">/etc/valiases/mydomain.com - but the address it was forwarding to... which was another [font="courier new">[plain]@mydomain.com[/plain] email address, did not exist. And the domain has their default address set to [font="courier new">:fail: messages. So the server was accepting the email for [font="courier new">[plain]cpanel@mydomain.com[/plain] because the email address exists as a forwarder in [font="courier new">/etc/valiases/mydomain.com But the address that [font="courier new">[plain]cpanel@mydomain.com[/plain] was set to forward to does not exist, so the message is sent to the default address for [font="courier new">mydomain.com. The default address for [font="courier new">mydomain.com is set to [font="courier new">:fail: messages. So the server is left to send the bounceback rejection message. Solution... remove the [font="courier new">[plain]cpanel@mydomain.com[/plain] forwarder from the [font="courier new">/etc/valiases/mydomain.com file - it wasn't receiving mail anyway. Did you by chance check for case-insensitive matches in [font="courier new">/etc/valiases/mydomain.com ? [font="courier new">[plain]grep -i cpanel@mydomain.com /etc/valiases/mydomain.com[/plain]
    0
  • sparek-3
    Additionally, is mail for [font="courier new">mydomain.com perhaps forwarding to another domain on the server? Is there anything in the file: [font="courier new">/etc/vdomainaliases/mydomain.com I can't remember exactly where this is set up in cPanel or really how it is used. Been a long time since I've messed with this. But if [font="courier new">/etc/vdomainaliases/mydomain.com has the contents: [font="courier new">mydomain.com: myotherdomain.com Then all mail for [font="courier new">mydomain.com will be forwarded to a corresponding [font="courier new">[plain]@myotherdomain.com[/plain] email address. [font="courier new">/etc/valiases/myotherdomain.com may contain a [font="courier new">[plain]cpanel@myotherdomain.com[/plain] forwarder that is forwarding to a non-existant email address.
    0
  • keat63
    I have nothing in either of those locations. :(
    0
  • keat63
    I assume that we've drawn a blank on this.
    0
  • sparek-3
    That's all I can think of at the moment. It's often just difficult to diagnose something that I don't have access to. You might check to see if [font="courier new">[plain]cpanel@mydomain.com[/plain] exists any where in /etc [font="courier new">[plain]grep -lr cpanel@mydomain.com /etc[/plain] That's about the only thing I have left.
    0
  • keat63
    No, nothing found
    0
  • sparek-3
    What is the default address for mydomain.com set to? [font="courier new">cat /etc/valiases/mydomain.com | grep ^\*
    0
  • keat63
    "fail: No such person at this address."
    0
  • keat63
    In another thread I doscovered that my domain is under some form of spoofing, resulting in me tightening spf (-all) Could this be related. As crazy as this may sound, could my server be somehow processing emails from this rogue server If the email address exists on the rogue server, could the real domain then assume that it must exist on my server and is sending it to fail rather than reject.
    0
  • keat63
    I'm still trying to get to the bottom of this. Today I decided to maybe create an email account 'cpanel', see what happens when I then delete it. Upon trying to create the account i got the following error. Error: Sorry, "cpanel" is a reserved username. Please choose another name. does this give any clues
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post