Existence of email order checking

keat63

• March 11, 2015 04:23

I found an email in the queue today from a mailbox that doesn't exist. It would appear that we had an old auto responder still configured, for an account that used to exist, so it sort of explains why there was a mail queued. However, considering the account doesn't exists, and there's no forwarder setup, how did the original spam ever get accepted. It seems that exim is configured to reply first and worry about the rest later. Should it not be the other way around.. check existence of account, check existence of forwarder, if neither exists, drop the mail ?

• 

  cPanelMichael

  • March 11, 2015 19:54

  Hello, What is configured as the "Default Address" for this domain name (cPanel >> Default Address)? Thank you.

  0
• 

  keat63

  • March 12, 2015 11:35

  all unrouted mail is configured to discard with a failure message.

  0
• 

  cPanelMichael

  • March 12, 2015 16:16

  It's acceptable to have an autoresponder when there's no email account associated with it, however if you do not create a forwarder or email account with the same address as the autoresponder, it will discard the message. What's the message you found in the queue, and what's it's associated entry in /var/log/exim_mainlog? Thank you.

  0
• 

  keat63

  • March 13, 2015 09:33

  I removed the job from the outgoing mail queue, but i've managed to recreate the issue. I have no account or forward rule configured for mickeymouse. I've just created the autoresponder for this experiment. Although I'm currently still waiting for the auto responder to reply, it seems that the message was accepted.
  2015-03-13 09:25:57 SMTP connection from [xx.xxx.xxx.xxx]:16880 (TCP/IP connection count = 1) 2015-03-13 09:26:00 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: Sender rate 1.0 / 1h 2015-03-13 09:26:02 1YWLqz-0007b2-O4 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: Message has been scanned: no virus or other harmful content was found 2015-03-13 09:26:04 1YWLqz-0007b2-O4 H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 Warning: "SpamAssassin as cpanel-user detected message as NOT spam (1.0)" 2015-03-13 09:26:04 1YWLqz-0007b2-O4 <= sales@test-sender.co.uk H=nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 P=esmtp S=5490 id=20150313092555.984FE100651@relay.mailchannels.net T="did this arrive" for mickeymouse@mydomain.com 2015-03-13 09:26:04 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1YWLqz-0007b2-O4 2015-03-13 09:26:04 1YWLqz-0007b2-O4 => |/usr/local/cpanel/bin/autorespond mickeymouse@mydomain.com /home/cpanel-user/.autorespond (mickeymouse@mydomain.com) R=virtual_aliases_nostar T=jailed_virtual_address_pipe 2015-03-13 09:26:04 1YWLqz-0007b2-O4 Completed 2015-03-13 09:26:05 SMTP connection from nov-007-i631.relay.mailchannels.net (relay.mailchannels.net) [xx.xxx.xxx.xxx]:16880 closed by QUIT
  

  0
• 

  cPanelMichael

  • March 13, 2015 14:12

  Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome. Thank you.

  0
• 

  keat63

  • March 13, 2015 15:24

  Hi Michael.. For security reasons, I removed all the firewall rules along with SSH keys from my last support ticket. However, I'm happy to open a ticket if you're unable to reproduce this in the lab ?

  0
• 

  cPanelMichael

  • March 13, 2015 16:19

  First, I suggest reading the following document to get a better idea of how auto responders work with Exim:

  0
• 

  keat63

  • March 13, 2015 17:33

  Despite mail delivery reports showing that the message was accepted, I never did actually receive the auto response. I'm going to put this down to pure lazyness or oversight on my side, for leaving an auto responder in place after removing an account.

  0

Please sign in to leave a comment.