On Sat, 9 Apr 2022 09:09:53 -0400 (EDT) Wietse Venema <wie...@porcupine.org> wrote:
> Fourhundred Thecat: > > Hello, > > > > I have suddenly started seeing following messages in my logs: > > > > timeout after END-OF-MESSAGE from a9-244.smtp-out.amazonses.com > > > > Full context here: https://ctxt.io/2/AABgbxFEFQ > > > > These errors are coming from completely unrelated clients. Are suddenly > > all clients on the internet misconfigured? I did not change anything on > > my side. > > Not in Postfix, but perhaps something was changed in the network stack. > > > I can provide more examples if necesary. > > 2022-04-09 09:27:31 postfix:25/smtpd: disconnect from > o196.p31.mailjet.com[185.211.122.196] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 > commands=6 > 2022-04-09 10:09:45 postfix:25/smtpd: disconnect from > a9-244.smtp-out.amazonses.com[54.240.9.244] ehlo=2 starttls=1 mail=1 rcpt=1 > data=1 commands=6 > > Note that Postfix received no QUIT command. > > Possible scenarios: > > 1) The client did not send QUIT and kept the connection open for > more than 20s. This is unlikely if it is a sudden change that affects > connections from many different clients. > > 2) The client did send QUIT and did close the connection, but some > overly aggressive NAT/packet filter dropped TCP connection state > when it saw that the client wants to close the connection. Since > this is a sudden change that affects connections from many different > clients, it is more likly to be on your end of the network. > > Wietse Few stats from my mail server : i manage few personal domains, little less that 100k email over a 2 years span. Over that period of time, i count 113 emails with "timeout after END-OF-MESSAGE" where Postfix didn't received a QUIT command. Look at the breakdown below : 61 amazonses.com 34 mailgun.net 5 mailin.fr 4 mailjet.com 3 9services.com 1 vadivar.com 1 rima-tde.net 1 passculture.app 1 fsnkaa.net 1 emsecure.net 1 co.th Knowing that mailgun bought mailjet back in 2019, this matches the OP's two lines sample pretty well. I also see such mails on my local LAN, mostly Apple devices, so no middlebox here, but maybe bad or too aggressive values on my side. So take these stats with caution, YMMV. Philippe
