cc email not delivered to mailbox
I've been asked why someone didn't receive an email.
We had a customer who attempted to send an email to one of my colleges.
I can see in the mail log, that he is on an RBL so this was rejected.
I also see 15 minutes later that he sent another message, so I'm assuming he must have seen a blacklist bounce, and tried again.
Only this time the message was delivered, which makes no sense as he sent from the same IP address (unless he somehow had the blacklist lifted in this short space of time )
Then to confuse matters, looking on the end users outlook screen, I can see that he CC'd someone else in, who didn't receive it, and I can't see any reference to the CC in the exim mainlog.
The second user has no filters configured, and nothing in outlook.
I'm confused.
-
Only this time the message was delivered, which makes no sense as he sent from the same IP address (unless he somehow had the blacklist lifted in this short space of time )
Hello, Did you try searching entering the IP address in the RBL's website to see if it's still listed? Thank you.0 -
I never thought of that to be honest, as I was more concerned with where the CC went. I have now checked Spamcop and he's not blacklisted, so maybe he did indeed delist. However, i'm still at a loss where the CC went. I can see the message headers from the client PC and can clearly see the CC. But noting in Exim Main Log referring to a CC. 0 -
Do you see any entries for the email address that was CC'd in /var/log/exim_mainlog? EX: exigrep cc'd-email@domain /var/log/exim_mainlog
Thank you.0 -
I can't see anything in that log against that recipient, either for the message ID or the senders email, however it's clearly visible from one end users PC. Received: from [79.xxx.xx.xx] (helo=AndrewPC) by mail149.extendcp.com with esmtpa (Exim 4.80.1) id 1YWO1h-0003Oz-Md; Fri, 13 Mar 2015 11:45:17 +0000 From: "Andrew Customer" To: Cc: [\code]0 -
Could you have the user try making that delivery again, or can you reproduce the issue with your own email client? If the email address is not found in /var/log/exim_mainlog, it typically indicates that Exim did not process the message. Thank you. 0 -
I did try a test before i left the office sending an email to nicky with a cc to janine from an unrelated domain sitting on a totally different server, and this was delivered to both accounts. 0 -
It seems like it might be isolated to that individual email client. Check to see if the user can reproduce the issue with another email. Thank you. 0 -
When you say email client, I assume you mean Outlook ? That wouldn't explain why I can find it exim logs though. looking at the first few entries, could it have gone through some sort of relay, and maybe stripped something out? Message Headers Received: from mailscan34.extendcp.co.uk ([79.xxx.xx.x]:45890 helo=mailscan1.extendcp.co.uk) by my.hostname.co.uk with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.85) (envelope-from ) id 1YWOHb-00023E-7v for nicky@mydom.co.uk; Fri, 13 Mar 2015 12:01:41 +0000 Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mailscan1.hi.local) by mailscan-g71.hi.local with esmtp (Exim 4.80.1) (envelope-from ) id 1YWO2l-0005K7-Ug; Fri, 13 Mar 2015 11:46:19 +0000 Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mail149.extendcp.co.uk) by mailscan1.hi.local with esmtps (UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.80.1) (envelope-from ) id 1YWO2W-0005Zp-8j; Fri, 13 Mar 2015 11:46:19 +0000 Received: from [79.170.72.99] (helo=AndrewPC) by mail149.extendcp.com with esmtpa (Exim 4.80.1) id 1YWO1h-0003Oz-Md; Fri, 13 Mar 2015 11:45:17 +0000 From: "Andrew " To: Cc: Subject: Purchase Order 6730 Date: Fri, 13 Mar 2015 11:45:06 -0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0056_01D05D83.299F9E90" X-Mailer: Microsoft Outlook 15.0 Content-Language: en-gb X-WatchGuard-Spam-ID: str=0001.0A0B0201.5502D245.02D4,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 X-Antivirus: avast! (VPS 150312-4, 12/03/2015), Inbound message X-Antivirus-Status: Clean [\code]0 -
Hello, It depends on the specific nature of how the user's local workstation is configured. From what I understand, the issue is isolated to this particular user's workstation. Does the issue persist when they send email from Thunderbird instead of Outlook? Is there any special email relay configured for their domain name? Thank you. 0 -
All the PC's have MS Outlook, all configured the same. Nobody has any specific rules configured. Each Cpanel Mailbox is configured the same way (different passwords of course) What's confused me is on one email client, I can clearly see the CC to a colleague. If i look at those headers (attached above), again, I can see the CC. The CC never arrived, and I can't find it in exim logs, spam folders, junk folders, deleted folders. It's as if it was never CC'd. Here is the exim log for that particular email. 2015-03-13 12:01:38 SMTP connection from [xx.xxx.xxx.xxx]:45890 (TCP/IP connection count = 1) 2015-03-13 12:01:38 H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: Sender rate 1.0 / 1h 2015-03-13 12:01:39 1YWOHb-00023E-7v H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: Message has been scanned: no virus or other harmful content was found 2015-03-13 12:01:41 1YWOHb-00023E-7v H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 Warning: "SpamAssassin as cpanel-user detected message as NOT spam (-0.0)" 2015-03-13 12:01:41 1YWOHb-00023E-7v <= andrew@customer.co.uk H=mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 P=esmtps X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 S=148300 id=!&!AAAAAAAAAAAYAAAAAAAAAC6NC67g7SVOiXzfLPcm6Z/CgAAAEAAAADgatA8rPF9PkhY394ntAjkBAAAAAA==@customer.co.uk T="Purchase Order 6730" for nicky@mydom.com 2015-03-13 12:01:41 SMTP connection from mailscan34.zzz.co.uk (mailscan1.zzz.co.uk) [xx.xxx.xxx.xxx]:45890 closed by QUIT 2015-03-13 12:01:41 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1YWOHb-00023E-7v 2015-03-13 12:01:41 1YWOHb-00023E-7v => nicky R=virtual_user T=virtual_userdelivery 2015-03-13 12:01:41 1YWOHb-00023E-7v Completed [\code]0 -
I've just been and looked again on the receivers PC, wondering if maybe it was an attached email, but it's a regular email with a CC. I guess there's not a great deal we can do unless we spot re-occurrences, but it would be nice to understand why it went missing. 0 -
You may want to check with Outlook's support because it's not happening with other email clients and there's no mention of it in the Exim logs. Thank you. 0 -
Hi Michael. This is what I don't understand. If you look at the headers from one client PC, you can see the CC. #5 & #9 But not in the exim logs. #11 0 -
That indicates to me the issue is with the email client on that particular computer, as opposed to an issue with cPanel or Exim, since Exim never sees the message. Thank you. 0 -
So are these logs showing the client downloading it from exim ? And If this is the case, is there a log anywhere that shows the message landing in the users mailbox (prior to download by the client) 0 -
So are these logs showing the client downloading it from exim ? And If this is the case, is there a log anywhere that shows the message landing in the users mailbox (prior to download by the client)
I'm under the assumption that you are referring to a problem the user has when "sending" a message from the desktop email client when using the "CC" option. Could you elaborate on what specific part of the log shows any aspect of that cc'd address? Thank you.0 -
An external customer sent an email to one user (Nicky) and CC'd another user (Janine). Both Nicky and Janine are users on my domain. Nicky received the email, and I can see from the email and its ascociated email headers that Janine was CC'd. Janine never received the CC. 0 -
It seems like an issue with the email client, but feel free to open a support ticket so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome. Thank you. 0 -
Hi Michael Now that we've ascertained the direction of the email, is there anything i need to search for in the logs, that would indicate a CC for the missing email in question ? On line 22, post #9, (email headers from client PC), we can see the CC. Just can't seem to locate it in the exim logs. 0 -
You can search for the address via: exigrep user@domain /var/log/exim_mainlog
As mentioned, if it's not in the logs, and you feel it's not an issue with the individual's email client, then feel free to open a support ticket so we can take a closer look. Thank you.0 -
I've created ticket 6276223. I've opened firewall, CPHulk, Host Access Control, granted access etc, but test is timing out. Please let me know if your'e unable to connect. 0 -
To update, it was determined the mail was rejected as the delivering IP address is listed in an RBL. Thank you. 0 -
Hi Michael. I'm not convinced that this is the case. This wouldn't explain why one user received the email and another one didn't. Surely if the email was blocked by an RBL listing, it would have been blocked to both users and not just one. ?? As previously determined, the email appears to have been sent twice. 1. at 11:46 was rejected by RBL 2. at 12:01 was accepted and delivered to one user, but wasn't delivered to the cc'd user. 0 -
Please ensure you communicate this information in the support ticket so we can continue to troubleshoot the issue, and update us with the outcome. Thank you. 0
Please sign in to leave a comment.
Comments
24 comments