Message from host google.com, sometimes, duplicate delivery with same Message-ID Exim
Hello!
About 48 hours ago, we detected some mails form google.com host sometimes arrive duplicated (sometimes triplicated).
We investigated the headers on we detected all messages have the same Message-ID and X-Received,
We checked this mails with exigrep, and these are the logs:
X-Received:
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
X-Received: by 2002:a05:600c:4043:b0:490:b2a6:8c2a with SMTP id 5b1f17b1804b1-490b5e748e3mr592495e9.5.1780425702178; Tue, 02 Jun 2026 11:41:42 -0700 (PDT)
--------------------------------------
2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O H=mail-wm1-f48.google.com [209.85.128.48]:52709 Warning: "SpamAssassin as xxxx detected message as NOT spam (-1.7)"
2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O H=mail-wm1-f48.google.com [209.85.128.48]:52709 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:42:24 1wUU4F-0000000CC1s-1R1O <= xxxxx@gmail.com H=mail-wm1-f48.google.com [209.85.128.48]:52709 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20046 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:42:24 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4F-0000000CC1s-1R1O
2026-06-02 20:42:25 1wUU4F-0000000CC1s-1R1O => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> cDR8BxEkH2qIWCwA7bFxZg Saved"
2026-06-02 20:42:25 1wUU4F-0000000CC1s-1R1O Completed
2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy H=mail-ej1-f50.google.com [209.85.218.50]:53563 Warning: "SpamAssassin as xxxx detected message as NOT spam (-1.7)"
2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy H=mail-ej1-f50.google.com [209.85.218.50]:53563 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:42:34 1wUU4Q-0000000CC28-0QSy <= xxxxx@gmail.com H=mail-ej1-f50.google.com [209.85.218.50]:53563 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20082 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:42:34 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4Q-0000000CC28-0QSy
2026-06-02 20:42:35 1wUU4Q-0000000CC28-0QSy => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> d/wgCBskH2qSWCwA7bFxZg Saved"
2026-06-02 20:42:35 1wUU4Q-0000000CC28-0QSy Completed
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji H=mail-ej1-f45.google.com [209.85.218.45]:53503 Warning: "SpamAssassin as xxxxx detected message as NOT spam (-1.7)"
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji H=mail-ej1-f45.google.com [209.85.218.45]:53503 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji <= xxxxx@gmail.com H=mail-ej1-f45.google.com [209.85.218.45]:53503 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=20083 id=00317539-CB39-4879-B36B-A19A62855796@gmail.com T="Re: Subject" for info@xxxxx.com
2026-06-02 20:43:05 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1wUU4u-0000000CC2q-21ji
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji => info <info@xxxxx.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@xxxxx.com> gDtzIDkkH2rCWCwA7bFxZg Saved"
2026-06-02 20:43:05 1wUU4u-0000000CC2q-21ji Completed
As you can see all have same Message-ID: 00317539-CB39-4879-B36B-A19A62855796@gmail.com
The fist on is processed correctly and returms the code 250 2.0.0 in 1 second and it returns Completed. But Google resend two more messages from diferents hosts ¿??¿?¿
Can anyone help us?
-
@cPRex Thanks for the update. Was this update just an unchanged and repacked rpm from upstream? Any other data you can share?
0 -
I'm saying there was no update from our end that caused this behavior and it's something on the Gmail side of things as other non-cPanel users are reporting this behavior as well.
1 -
cPRex Disabling the delay hasn't solved the problem. Do you have an ETA? Any news on this matter?
0 -
For now, we have added Google's SMTP IP addresses to Exim Configuration, Access Lists, Trusted SMTP IP addresses and this appears to have resolved our issue. We have not detected any duplicates over the last few hours.
0 -
SoporteNTX - I don't have any other information other than what has already been posted at this point.
0 -
Allen Daniels how does one find all Google's SMTP IP addresses?
0 -
Vander Host I just took the IP addresses they show in their SPF record, see below.
v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all
0 -
I think the best workaround so far is executing this:
# Add also IPv6 IPs if you use it
echo "74.125.0.0/16" >> /etc/skipsmtpcheckhosts
echo "209.85.128.0/17" >> /etc/skipsmtpcheckhostsand keep "Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam" ON
0 -
Hi everyone! Just a few minute ago we detected same issue, only with 2/3 mails duplicates. (For now...) Same ID also but the time is very strange. One duplicate exactly the same time and the other 28 seconds later.. I don't undestand anything. The logs:
2026-06-05 16:01:48 1wVV7M-0000000EyPj-31B2 H=mail-pg1-f180.google.com [209.85.215.180]:60827 Warning: "SpamAssassin as server detected message as NOT spam (-2.1)"
2026-06-05 16:01:48 1wVV7M-0000000EyPj-31B2 H=mail-pg1-f180.google.com [209.85.215.180]:60827 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-05 16:01:48 1wVV7M-0000000EyPj-31B2 <= aaa@gmail.com H=mail-pg1-f180.google.com [209.85.215.180]:60827 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=24331 id=CAJbzstHPta4mdhtEX6LwONp75M9am2Xs1mFdTgjr7B6s7S+p0A@mail.gmail.com T="Re: factur" for info@myserver.com
2026-06-05 16:01:48 1wVV7M-0000000EyPj-31B2 => info <info@myserver.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@myserver.com> dwWXNczWImrFdDYA7bFxZg Saved"
2026-06-05 16:01:48 1wVV7M-0000000EyPj-31B2 Completed2026-06-05 16:02:16 1wVV7o-0000000EyQq-0xf0 H=mail-yw1-f179.google.com [209.85.128.179]:60900 Warning: "SpamAssassin as server detected message as NOT spam (-2.1)"
2026-06-05 16:02:16 1wVV7o-0000000EyQq-0xf0 H=mail-yw1-f179.google.com [209.85.128.179]:60900 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-05 16:02:16 1wVV7o-0000000EyQq-0xf0 <= aaa@gmail.com H=mail-yw1-f179.google.com [209.85.128.179]:60900 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=23968 id=CAJbzstHPta4mdhtEX6LwONp75M9am2Xs1mFdTgjr7B6s7S+p0A@mail.gmail.com T="Re: factur" for info@myserver.com
2026-06-05 16:02:16 1wVV7o-0000000EyQq-0xf0 => info <info@myserver.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info@myserver.com> d7DXD+jWImoQdTYA7bFxZg Saved"
2026-06-05 16:02:16 1wVV7o-0000000EyQq-0xf0 Completed----------------------------------------------------------------------------------------------------------------
2026-06-05 16:04:00 1wVV9K-0000000EyW7-2IzT H=mail-pf1-f180.google.com [209.85.210.180]:57828 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-05 16:04:00 1wVV9K-0000000EyW7-2IzT <= aaa@bbb.studio H=mail-pf1-f180.google.com [209.85.210.180]:57828 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=26481510 id=CAKvWZ-Ng++3b4=jy=pdbeOkZSSXZOCpQwKAcXJSs4U2cBoFdew@mail.gmail.com T="1.037_Project" for helo@myserver.com
2026-06-05 16:04:00 1wVV9K-0000000EyW7-2IzT => helo <helo@myserver.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <helo@myserver.com> xHVCEFDXImpwdjYA7bFxZg Saved"
2026-06-05 16:04:00 1wVV9K-0000000EyW7-2IzT Completed2026-06-05 16:04:00 1wVV99-0000000EyVe-3knT H=mail-pj1-f47.google.com [209.85.216.47]:56552 Warning: Message has been scanned: no virus or other harmful content was found
2026-06-05 16:04:00 1wVV99-0000000EyVe-3knT <= aaa@bbb.studioo H=mail-pj1-f47.google.com [209.85.216.47]:56552 P=esmtps X=TLS1.3:TLS_AES_128_GCM_SHA256:128 S=26481507 id=CAKvWZ-Ng++3b4=jy=pdbeOkZSSXZOCpQwKAcXJSs4U2cBoFdew@mail.gmail.com T="1.037_Project" for helo@myserver.com
2026-06-05 16:04:00 1wVV99-0000000EyVe-3knT => helo <helo@myserver.com> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <helo@myserver.com> QeToD1DXImpudjYA7bFxZg Saved"
2026-06-05 16:04:00 1wVV99-0000000EyVe-3knT CompletedAny idea?
Marc0 -
Hi!!
I've noticed a pattern in the duplicate messages google host.In all the duplicate messages we've received, the Google server ending in "f180.google.com" was always involved.
Is there any way to explain this to Google?
0 -
in the new cpanel version changelog it shows:
Fixed CPANEL-53893: Fixed a case where common mail providers such as Gmail could deliver duplicate inbound messages when the SMTP delay for unknown hosts was enabled.
Could you elaborate on this issue so the community can better understand what was fixed?
0 -
Hello, that would be helpful, can I switch on again the delay option?
0 -
Daniel Bazaes - We fixed it by making WHM >> Exim Configuration Manager's setting for 'Do not delay the SMTP connections for hosts in the Greylisting “Common Mail Providers” list' default to 'On' and made this setting's operation no longer be contingent on having greylisting enabled for the server.
interwave - let me know if this answer also helps you.
0
Please sign in to leave a comment.
Comments
43 comments