Skip to main content

Message from host google.com, sometimes, duplicate delivery with same Message-ID Exim

galileuNet

Hello!
About 48 hours ago, we detected some mails form google.com host sometimes arrive duplicated (sometimes triplicated).
We investigated the headers on we detected all messages have the same Message-ID and X-Received, 
We checked this mails with exigrep, and these are the logs:

X-Received:
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
--------------------------------------

2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O H=mail-wm1-f48.google.com [209.85.128.48]:52709 Warning: "SpamAssassin as xxxx detected message as NOT spam (-1.7)"
2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O H=mail-wm1-f48.google.com [209.85.128.48]:52709 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O <= xxxxx@gmail.com H=mail-wm1-f48.google.com [209.85.128.48]:52709 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20046 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:42:24 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4F-0000000CC1s-1R1O
2026-06-02 20:42:25 1wUU4F-0000000CC1s-1R1O => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> cDR8BxEkH2qIWCwA7bFxZg Saved"
2026-06-02 20:42:25 1wUU4F-0000000CC1s-1R1O Completed


2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy H=mail-ej1-f50.google.com [209.85.218.50]:53563 Warning: "SpamAssassin as xxxx detected message as NOT spam (-1.7)"
2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy H=mail-ej1-f50.google.com [209.85.218.50]:53563 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy <= xxxxx@gmail.com H=mail-ej1-f50.google.com [209.85.218.50]:53563 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20082 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:42:34 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4Q-0000000CC28-0QSy
2026-06-02 20:42:35 1wUU4Q-0000000CC28-0QSy => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> d/wgCBskH2qSWCwA7bFxZg Saved"
2026-06-02 20:42:35 1wUU4Q-0000000CC28-0QSy Completed


2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji H=mail-ej1-f45.google.com [209.85.218.45]:53503 Warning: "SpamAssassin as xxxxx detected message as NOT spam (-1.7)"
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji H=mail-ej1-f45.google.com [209.85.218.45]:53503 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji <= xxxxx@gmail.com H=mail-ej1-f45.google.com [209.85.218.45]:53503 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20083 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:43:05 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4u-0000000CC2q-21ji
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> gDtzIDkkH2rCWCwA7bFxZg Saved"
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji Completed 

As you can see all have same Message-ID: 00317539-CB39-4879-B36B-A19A62855796@gmail.com

The fist on is processed correctly and returms the code 250 2.0.0 in 1 second and it returns Completed. But Google resend two more messages from diferents hosts ¿??¿?¿

Can anyone help us? 

Comments

39 comments

Date Votes
  • TCH
    • Edited

    @cPRex Thanks for the update. Was this update just an unchanged and repacked rpm from upstream? Any other data you can share?

    0
  • cPRex Jurassic Moderator

    I'm saying there was no update from our end that caused this behavior and it's something on the Gmail side of things as other non-cPanel users are reporting this behavior as well.

    1
  • SoporteNTX

    cPRex Disabling the delay hasn't solved the problem. Do you have an ETA? Any news on this matter?

    0
  • Allen Daniels

    For now, we have added Google's SMTP IP addresses to Exim Configuration, Access Lists, Trusted SMTP IP addresses and this appears to have resolved our issue. We have not detected any duplicates over the last few hours.

    0
  • cPRex Jurassic Moderator

    SoporteNTX - I don't have any other information other than what has already been posted at this point.

    0
  • Vander Host

    Allen Daniels how does one find all Google's SMTP IP addresses?

    0
  • Allen Daniels

    Vander Host I just took the IP addresses they show in their SPF record, see below.

    v=spf1 
ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 
ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 
ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

     

    0
  • imorandin

    I think the best workaround so far is executing this:

    # Add also IPv6 IPs if you use it
    echo "74.125.0.0/16" >> /etc/skipsmtpcheckhosts
    echo "209.85.128.0/17" >> /etc/skipsmtpcheckhosts

    and keep "Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam" ON

    0
  • galileuNet

    Hi!!
    I've noticed a pattern in the duplicate messages google host.

    In all the duplicate messages we've received, the Google server ending in "f180.google.com" was always involved.

    Is there any way to explain this to Google?

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post