We've been having an intermittent problem with mail originating from a specific domain, which may or may not be related to a specific host or message type. It seems that the sending host is timing out before it finishes the message transmission. I enabled debug logging (and bumped up the smtp timeout back to 300s) for this domain.
Just to be sure I'm not barking up the wrong tree, would I expect to see a log entry for the EOM in the verbose log from the sending server if it existed? Here're some snipped logs: May 20 10:22:22 smtp3 postfix/smtpd[17136]: connect from dfw-mailout1.example.com[199.xxx.xxx.xx] May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 220 smtp3.ourdomain.example.net ESMTP Postfix May 20 10:22:22 smtp3 postfix/smtpd[17136]: < dfw-mailout1.example.com[199.xxx.xxx.xx]: EHLO dfw-mailout1.example.com May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-smtp3.ourdomain.example.net May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-PIPELINING May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-SIZE 10485760 May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-ETRN May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-ENHANCEDSTATUSCODES May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250-8BITMIME May 20 10:22:22 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250 DSN May 20 10:22:23 smtp3 postfix/smtpd[17136]: < dfw-mailout1.example.com[199.xxx.xxx.xx]: MAIL From:<xu...@example.com.au> SIZE=486707 May 20 10:22:23 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250 2.1.0 Ok May 20 10:22:23 smtp3 postfix/smtpd[17136]: < dfw-mailout1.example.com[199.xxx.xxx.xx]: RCPT To:<yu...@ourdomain.example.net> May 20 10:22:24 smtp3 postfix/smtpd[17136]: 3697B2080A4: client=dfw-mailout1.example.com[199.xxx.xxx.xx] May 20 10:22:24 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 250 2.1.5 Ok May 20 10:22:24 smtp3 postfix/smtpd[17136]: < dfw-mailout1.example.com[199.xxx.xxx.xx]: DATA May 20 10:22:24 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 354 End data with <CR><LF>.<CR><LF> May 20 10:27:25 smtp3 postfix/smtpd[17136]: > dfw-mailout1.example.com[199.xxx.xxx.xx]: 421 4.4.2 smtp3.ourdomain.example.net Error: timeout exceeded It seems pretty clear to me that we didn't receive an EOM (especially since the timeout-exceeded caused the disconnection), but since I'm going to be telling them it's a problem at their end, I'd like to be sure I'm not telling them a pile of rubbish. I'm also going to try some tcpdump logging to see what I can find - any recommendations for what I should be looking for? Thanks.
