Re: How to tell my ISP there's a problem

[Matus UHLAR - fantomas]

On 18.06.19 21:15, Chris Pollock wrote:

I'd been told quite awhile back that the spf soft failure isn't a
problem by Centurylink  Be that as it may I went into chat with
Centurylink tech support this afternoon. I had all the information that
I could think of to share with them. After over an hour of trying to
explain what the problem is I got absolutely no where. In fact the 2nd
person I went into chat with just up and terminated the chat on me in
the middle of it. I was on the verge of changing my postfix setup to
use my gmail account when I decided to try one last thing and that was
to change the port from 25 to 587. After updating postfix files and
reloading postfix I changed the time on the spamassassin update cronjob
and let it run. Amazingly the message I expected was sent and received.
I can only conclude that making the change from port 25 to 587 made the
difference. I'll know for sure tomorrow when the SA-Update cronjob runs
at the regular time.


since port 587 requires authentication, different spam checks are often
applied there.


One last item, this isn't a mail server but just my home Ubuntu system.


so you should use authentication when sending mail from it. So do I.


I've had postfix setup for many years from way back in my Mandrake days
in order to easily send output of cronjobs to myself. It's probably
overkill but it works fine for me and runs without any problems (except
this last one).


time changes, so do requirements. Good that you solved it.

--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Posli tento mail 100 svojim znamim - nech vidia aky si idiot
Send this email to 100 your friends - let them see what an idiot you are

Re: Some mails just stay in Queue.

[Durga Prasad Malyala]

On Wed, Jun 19, 2019, 11:47 Olivier  wrote:

> Durga Prasad Malyala  writes:
>
> > Hello all,
> > I am seeing a peculiar problem in on of our servers. Some mails in the
> > queue stay there forever. of course they are very few just 20 or 30 in
> > a month.
> > most of them are from MAILER-DAEMON
> >
> > 3291B6063914!   54880 Mon Jun 17 17:32:24  MAILER-DAEMON
> >  veeren...@datasoftcomnet.com
> >
> > 2FF8A601819C!   29081 Mon Jun 17 18:44:24  MAILER-DAEMON
> >  veeren...@datasoftcomnet.com
> >
> > 20D90601819D! 1041140 Tue Jun 18 16:14:20  eb...@jio.com
> >  d...@datasoftcomnet.com
> > some are from others as well.
> >
> > I've tried everything like postfix flush, restarting the services etc.
> > still they stay there.
> > Any hints please?
>
> Usually, postqueue -p gives the reason why the messages a queued.
>
> Anything your side?
>
> Olivier
>
>
>

> Hi,
Thanks for your reply.  It's not giving any extra output.
I'm getting same list of queued mails.

DP

Re: Some mails just stay in Queue.

[Viktor Dukhovni]

On Wed, Jun 19, 2019 at 11:43:13AM +0530, Durga Prasad Malyala wrote:

> I am seeing a peculiar problem in on of our servers. Some mails in the
> queue stay there forever. of course they are very few just 20 or 30 in
> a month.

That's what the "hold" queue is for.

> 3291B6063914!   54880 Mon Jun 17 17:32:24  MAILER-DAEMON
>  veeren...@datasoftcomnet.com
> 
> 2FF8A601819C!   29081 Mon Jun 17 18:44:24  MAILER-DAEMON
>  veeren...@datasoftcomnet.com
> 
> 20D90601819D! 1041140 Tue Jun 18 16:14:20  eb...@jio.com
>  d...@datasoftcomnet.com

Don't put these messages "on hold" (the "!" after the queue id
means "on hold").

> I've tried everything like postfix flush, restarting the services etc.
> still they stay there.

Postfix does not put messages "on hold" by default.  So
you're choosing to do that by some means.  Don't do that
if you don't want to.

-- 
Viktor.

Mails to gmail bouncing

[Ralf Hildebrandt]

I have a strange problem with mails to GMAIL.
A user sent out mails to 90 recipients, half of which are @gmail.com,
and those mostly bounced:

Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 - 
gsmtp (in reply to DATA command))
Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 - 
gsmtp (in reply to DATA command))

The error message says:
 
Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 
OK w9si551343wmd.47 - gsmtp (in reply to DATA command)

Other recipients were @yahoo.com, and some even hosted on google
(uniroma1.it):

Jun 19 09:52:42 mail-cvk postfix/smtp[32079]: 45THH93PXyz1Z4Kq: 
to=, relay=ASPMX.L.GOOGLE.COM[173.194.76.27]:25, 
delay=4.7, delays=3.3/0.44/0.42/0.58, dsn=2.0.0, status=sent (250 2.0.0 OK 
1560930762 l7si9891184wrx.266 - gsmtp)
Jun 19 09:52:44 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=alt1.gmail-smtp-in.l.google.COM[108.177.14.26]:25, delay=6.7, 
delays=3.3/0.04/2.9/0.44, dsn=2.0.0, status=sent (250 2.0.0 OK 1560930764 
q30si13988623lfb.86 - gsmtp)

so the answer 

 "250 2.0.0 OK 1560930762 l7si9891184wrx.266 - gsmtp"

is acceptable, while

 "250 2.1.5 OK w9si551343wmd.47 - gsmtp"

is a protocol error?

https://tools.ietf.org/html/rfc3463
says about the extended code 2.1.5:

2.XXX.XXX   Success
X.1.5   Destination address valid


-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
   
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Re: Mails to gmail bouncing

[Ralf Hildebrandt]

>  "250 2.0.0 OK 1560930762 l7si9891184wrx.266 - gsmtp"
> 
> is acceptable, while
> 
>  "250 2.1.5 OK w9si551343wmd.47 - gsmtp"
> 
> is a protocol error?

I fired up ye olde grep on mail.python.org and found some incidients
there as well:

# zegrep -c "status=bounced \(Protocol error: host gmail.* 250 2\.1\.5" 
/var/log/mail.log*
/var/log/mail.log:2
/var/log/mail.log.1:6
/var/log/mail.log.2.gz:8
/var/log/mail.log.3.gz:3
/var/log/mail.log.4.gz:9
/var/log/mail.log.5.gz:10
/var/log/mail.log.6.gz:34
/var/log/mail.log.7.gz:21
/var/log/mail.log.8.gz:26
/var/log/mail.log.9.gz:8
/var/log/mail.log.10.gz:3
/var/log/mail.log.11.gz:5
/var/log/mail.log.12.gz:4
/var/log/mail.log.13.gz:5
/var/log/mail.log.14.gz:9
/var/log/mail.log.15.gz:12
/var/log/mail.log.16.gz:8
/var/log/mail.log.17.gz:6
/var/log/mail.log.18.gz:23
/var/log/mail.log.19.gz:17
/var/log/mail.log.20.gz:8
/var/log/mail.log.21.gz:9
/var/log/mail.log.22.gz:5
/var/log/mail.log.23.gz:0
/var/log/mail.log.24.gz:0
/var/log/mail.log.25.gz:5
/var/log/mail.log.26.gz:4
/var/log/mail.log.27.gz:19
/var/log/mail.log.28.gz:7

-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
   
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Re: Mails to gmail bouncing

[Viktor Dukhovni]

> On Jun 19, 2019, at 6:37 AM, Ralf Hildebrandt  wrote:
> 
> The error message says:
> 
> Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 
> 2.1.5 OK w9si551343wmd.47 - gsmtp (in reply to DATA command)

Ralf, your inattention to detail disappoints me. :-(

The correct reply to "DATA" is "354" not "250".  Something is awfully
out of sync if Gmail is returning "250" in response to "DATA".

That's presumably a response for one of the recipients, so Gmail
sent one more response than Postfix expects, or Gmail received
one more command than Postfix expected to send.
 
-- 
Viktor.

Re: Mails to gmail bouncing

[Matus UHLAR - fantomas]

On 19.06.19 12:37, Ralf Hildebrandt wrote:

I have a strange problem with mails to GMAIL.
A user sent out mails to 90 recipients, half of which are @gmail.com,
and those mostly bounced:

Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 - gsmtp 
(in reply to DATA command))
Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 - gsmtp 
(in reply to DATA command))

The error message says:

Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 
OK w9si551343wmd.47 - gsmtp (in reply to DATA command)


really strange, since both 250 and 2.1.5 are successful error codes.
do you have anything non-standard in transport maps?


Other recipients were @yahoo.com, and some even hosted on google
(uniroma1.it):

Jun 19 09:52:42 mail-cvk postfix/smtp[32079]: 45THH93PXyz1Z4Kq: 
to=, relay=ASPMX.L.GOOGLE.COM[173.194.76.27]:25, 
delay=4.7, delays=3.3/0.44/0.42/0.58, dsn=2.0.0, status=sent (250 2.0.0 OK 1560930762 
l7si9891184wrx.266 - gsmtp)
Jun 19 09:52:44 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=alt1.gmail-smtp-in.l.google.COM[108.177.14.26]:25, delay=6.7, 
delays=3.3/0.04/2.9/0.44, dsn=2.0.0, status=sent (250 2.0.0 OK 1560930764 
q30si13988623lfb.86 - gsmtp)

so the answer

"250 2.0.0 OK 1560930762 l7si9891184wrx.266 - gsmtp"

is acceptable, while

"250 2.1.5 OK w9si551343wmd.47 - gsmtp"

is a protocol error?

https://tools.ietf.org/html/rfc3463
says about the extended code 2.1.5:

2.XXX.XXX   Success
X.1.5   Destination address valid


--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Holmes, what kind of school did you study to be a detective?
- Elementary, Watson.  -- Daffy Duck & Porky Pig

Re: Mails to gmail bouncing

[Ralf Hildebrandt]

* Viktor Dukhovni :
> > On Jun 19, 2019, at 6:37 AM, Ralf Hildebrandt  wrote:
> > 
> > The error message says:
> > 
> > Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 
> > 2.1.5 OK w9si551343wmd.47 - gsmtp (in reply to DATA command)
> 
> Ralf, your inattention to detail disappoints me. :-(

Probably getting old :)
 
> The correct reply to "DATA" is "354" not "250".  Something is awfully
> out of sync if Gmail is returning "250" in response to "DATA".

Yep. See the other logs from mail.python.org -- maybe this heavily
depends on connection caching or pipelining?
 
> That's presumably a response for one of the recipients, so Gmail
> sent one more response than Postfix expects, or Gmail received
> one more command than Postfix expected to send.

-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
   
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Re: Some mails just stay in Queue.

[Durga Prasad Malyala]

On Wed, Jun 19, 2019, 15:41 Viktor Dukhovni 
wrote:

> On Wed, Jun 19, 2019 at 11:43:13AM +0530, Durga Prasad Malyala wrote:
>
> > I am seeing a peculiar problem in on of our servers. Some mails in the
> > queue stay there forever. of course they are very few just 20 or 30 in
> > a month.
>
> That's what the "hold" queue is for.
>
> > 3291B6063914!   54880 Mon Jun 17 17:32:24  MAILER-DAEMON
> >  veeren...@datasoftcomnet.com
> >
> > 2FF8A601819C!   29081 Mon Jun 17 18:44:24  MAILER-DAEMON
> >  veeren...@datasoftcomnet.com
> >
> > 20D90601819D! 1041140 Tue Jun 18 16:14:20  eb...@jio.com
> >  d...@datasoftcomnet.com
>
> Don't put these messages "on hold" (the "!" after the queue id
> means "on hold").
>
> > I've tried everything like postfix flush, restarting the services etc.
> > still they stay there.
>
> Postfix does not put messages "on hold" by default.  So
> you're choosing to do that by some means.  Don't do that
> if you don't want to.
>
> --
> Viktor.
>

Thanks for reply Victor.
Beats me why it is going into hold queue in the first place.
I'm using rspamd if that is any clue. But it happens only for very few
mails.

DP

>

Re: Mails to gmail bouncing

[Ralf Hildebrandt]

* Viktor Dukhovni :

> The correct reply to "DATA" is "354" not "250".  Something is awfully
> out of sync if Gmail is returning "250" in response to "DATA".
> 
> That's presumably a response for one of the recipients, so Gmail
> sent one more response than Postfix expects, or Gmail received
> one more command than Postfix expected to send.

First entry for gmail was:

Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.2.2, status=bounced (host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 552 5.2.2 The email account 
that you tried to reach is over quota. Please direct (in reply to RCPT TO 
command))
Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 452-4.2.2 the recipient to 452 
4.2.2 https://support.google.com/mail/?p=OverQuotaTemp w9si551343wmd.47 - gsmtp 
(in reply to RCPT TO command)
Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 - 
gsmtp (in reply to DATA command))
... lots of protocol errors ...
Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, 
delay=4.8, delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol 
error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK 
w9si551343wmd.47 - gsmtp (in reply to DATA command))
Jun 19 09:52:44 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
to=, 
relay=alt1.gmail-smtp-in.l.google.COM[108.177.14.26]:25, delay=6.7, 
delays=3.3/0.04/2.9/0.44, dsn=2.0.0, status=sent (250 2.0.0 OK 1560930764 
q30si13988623lfb.86 - gsmtp)

so the first one causes an error (during the RCPT TO: stage) which then causes 
the rest to get out
of sync in the DATA stage - except for the last one (which goes to another 
server!)

-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
   
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Workaround: Mails to gmail bouncing

[Wietse Venema]

Ralf Hildebrandt:
> Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
> to=, 
> relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
> delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
> gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK w9si551343wmd.47 
> - gsmtp (in reply to DATA command))

Perhaps they messed up their SMTP command pipelining implementation.

Workaround:

/etc/postfix/main.cf:
   smtp_delivery_status_filter = pcre:/etc/postfix/smtp_dsn_filter

/etc/postfix/smtp_dsn_filter:
/^5(\.5\.0 Protocol error: .+ in reply to DATA command.+)/ 4$1

This way some deliveries will be delayed instead of bounced.

We could use debug_peer_list=google.com to make a recording (with
debug_peer_level=1).

Wietse

Re: Workaround: Mails to gmail bouncing

[Ralf Hildebrandt]

* Wietse Venema :
> Ralf Hildebrandt:
> > Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
> > to=, 
> > relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
> > delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
> > gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK 
> > w9si551343wmd.47 - gsmtp (in reply to DATA command))
> 
> Perhaps they messed up their SMTP command pipelining implementation.
> 
> Workaround:
> 
> /etc/postfix/main.cf:
>smtp_delivery_status_filter = pcre:/etc/postfix/smtp_dsn_filter
> 
> /etc/postfix/smtp_dsn_filter:
> /^5(\.5\.0 Protocol error: .+ in reply to DATA command.+)/ 4$1
> 
> This way some deliveries will be delayed instead of bounced.

I applied this at mail.python.org

> We could use debug_peer_list=google.com to make a recording (with
> debug_peer_level=1).

I applied this at mail.python.org

-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
   
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Re: Workaround: Mails to gmail bouncing

[Wietse Venema]

Wietse Venema:
> Ralf Hildebrandt:
> > Jun 19 09:52:43 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq: 
> > to=, 
> > relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25, delay=4.8, 
> > delays=3.3/0.04/0.62/0.84, dsn=5.5.0, status=bounced (Protocol error: host 
> > gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 2.1.5 OK 
> > w9si551343wmd.47 - gsmtp (in reply to DATA command))
> 

Additional workaround: do not reuse a session after protocol error.
Once a session is messed up, all subsequent reuses would fail too.

Wietse

--- /var/tmp/postfix-3.5-20190615/src/smtp/smtp_trouble.c   2017-12-27 
17:29:45.0 -0500
+++ src/smtp/smtp_trouble.c 2019-06-19 10:10:20.0 -0400
@@ -317,6 +317,8 @@
  */
 VSTRING_RESET(why->reason);
 if (mta_name && status && status[0] != '4' && status[0] != '5') {
+   SMTP_SESSION *session = state->session;
+   DONT_CACHE_THIS_SESSION;
vstring_strcpy(why->reason, "Protocol error: ");
status = "5.5.0";
 }

Re: Mails to gmail bouncing

[A. Schulze]

Am 19.06.19 um 12:53 schrieb Viktor Dukhovni:
>> On Jun 19, 2019, at 6:37 AM, Ralf Hildebrandt  wrote:
>>
>> The error message says:
>>
>> Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 
>> 2.1.5 OK w9si551343wmd.47 - gsmtp (in reply to DATA command)
> 
> Ralf, your inattention to detail disappoints me. :-(
> 
> The correct reply to "DATA" is "354" not "250".  Something is awfully
> out of sync if Gmail is returning "250" in response to "DATA".

to me this looks more as a 250 OK response _after_ data is sent because a 
typical queue ID is part of the response string.
I cannot see such errors at a "fast grep" here.

Wild guess: smtp-server (or your client) is abnormal and you hit exactly such 
an instance.
-> could you correlate the error with an IP?
-> could you enable debug_peer_list for one/some/all? servers generating this 
error?

and: which postfix version do you run?
( @mail-cvk <-> python.org )

Andreas 

Re: Some mails just stay in Queue.

[Noel Jones]

On 6/19/2019 6:13 AM, Durga Prasad Malyala wrote:


On Wed, Jun 19, 2019, 15:41 Viktor Dukhovni 
mailto:postfix-us...@dukhovni.org>> wrote:


On Wed, Jun 19, 2019 at 11:43:13AM +0530, Durga Prasad Malyala
wrote:

 > I am seeing a peculiar problem in on of our servers. Some
mails in the
 > queue stay there forever. of course they are very few just 20
or 30 in
 > a month.

That's what the "hold" queue is for.

 > 3291B6063914!   54880 Mon Jun 17 17:32:24  MAILER-DAEMON
 > veeren...@datasoftcomnet.com

 >
 > 2FF8A601819C!   29081 Mon Jun 17 18:44:24  MAILER-DAEMON
 > veeren...@datasoftcomnet.com

 >
 > 20D90601819D! 1041140 Tue Jun 18 16:14:20  eb...@jio.com
 > d...@datasoftcomnet.com 

Don't put these messages "on hold" (the "!" after the queue id
means "on hold").

 > I've tried everything like postfix flush, restarting the
services etc.
 > still they stay there.

Postfix does not put messages "on hold" by default.  So
you're choosing to do that by some means.  Don't do that
if you don't want to.

-- 
         Viktor.



Thanks for reply Victor.
Beats me why it is going into hold queue in the first place.
I'm using rspamd if that is any clue. But it happens only for very 
few mails.


DP




I don't use rspamd, but some milters with a "quarantine" action will 
put the mail on hold rather than moving the mail to a dedicated 
quarantine.



  -- Noel Jones

Re: Mails to gmail bouncing

[Wietse Venema]

A. Schulze:
> 
> 
> Am 19.06.19 um 12:53 schrieb Viktor Dukhovni:
> >> On Jun 19, 2019, at 6:37 AM, Ralf Hildebrandt  wrote:
> >>
> >> The error message says:
> >>
> >> Protocol error: host gmail-smtp-in.l.google.COM[173.194.76.26] said: 250 
> >> 2.1.5 OK w9si551343wmd.47 - gsmtp (in reply to DATA command)
> > 
> > Ralf, your inattention to detail disappoints me. :-(
> > 
> > The correct reply to "DATA" is "354" not "250".  Something is awfully
> > out of sync if Gmail is returning "250" in response to "DATA".
> 
> to me this looks more as a 250 OK response _after_ data is sent because a 
> typical queue ID is part of the response string.

My logs disagree. They show '250 2.1.5 OK gibberish - gsmtp' in
response to RCPT TO commands (in address verification probes).

whereas the end-of data response says '250 2.0.0 OK ...'.

So let's not confuse the problem with false speculation.

Wietse

RCPT TO response:

spike postfix/smtp[98630]: 45S7Pj6GFVzJrNr: to=<**censored**@gmail.com>, 
relay=gmail-smtp-in.l.google.com[172.217.197.27]:25, delay=0.53, 
delays=0.0018/0.013/0.36/0.15, dsn=2.1.5, status=deliverable (250 2.1.5 OK 
c9si6247152qvn.4 - gsmtp)

end-of-data response:

spike postfix/smtp[20694]: 45TVzq0TsDzJrNy: to=<**censored**@gmail.com>, 
relay=gmail-smtp-in.l.google.com[172.217.197.27]:25, delay=1.8, 
delays=0.11/0.013/0.55/1.1, dsn=2.0.0, status=sent (250 2.0.0 OK  1560962408 
h14si11564740qvj.217 - gsmtp)

Problem setting a TLS verified connection

[sral...@gmail.com]

Hi,


I'm trying to establish smtp_tls_security_level=verify connection with 
just one domain. I set a tls_policy in which I set domain verify, 
smtp_tls_security_level=may in main.cf. When we try to perform some test 
I can receive messages but is not possible to send I get deferred 4.7.0 
message. Any ideas? Thanks in advance.



D

From mail.log:


Outgoing message:

 Verified TLS connection established to MXhost[xxx.xxx.xxx.xxx]:25: 
TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)


postfix/smtp[]: : to=, 
relay=MXhost[xxx.xxx.xxx.xxx]:25, delay=2190, delays=2186/0.03/3.9/0.13, 
dsn=4.7.0, status=deferred (host MXdomain[xxx.xxx.xxx.xxx] said: 403 
4.7.0 not authenticated (in reply to MAIL FROM command))



**postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 48h
compatibility_level = 2
delay_warning_time = 2h
inet_interfaces = all
inet_protocols = ipv4
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
maximal_queue_lifetime = 48h
message_size_limit = 2500
milter_mail_macros = i {mail_addr} {client_addr} {client_name} 
{auth_authen}

milter_protocol = 6
mydestination = $myhostname, , localhost., , localhost
myhostname = 
mynetworks = 127.0.0.0/8 [:::127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = inet:127.0.0.1:11332
readme_directory = no
recipient_delimiter = +
relay_domains = 
relayhost =
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 2
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, TLSv1.1
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated 
check_client_access hash:/etc/postfix/whitelist

smtpd_milters = inet:127.0.0.1:11332
smtpd_recipient_limit = 4000
smtpd_recipient_restrictions = permit_mynetworks, 
permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org, 
reject_rhsbl_reverse_client dbl.spamhaus.org, reject_rhsbl_helo 
dbl.spamhaus.org, reject_rhsbl_sender dbl.spamhaus.org, 
reject_rbl_client b.barracudacentral.org, reject_rbl_client 
bl.spamcop.net, reject_rbl_client cbl.abuseat.org,
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, 
reject_unauth_destination

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = mysql:/etc/postfix/mysql4.cf
smtpd_sender_restrictions = permit_mynetworks permit_sasl_authenticated 
reject_authenticated_sender_login_mismatch check_sender_access 
hash:/etc/postfix/emailWL

smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/.pem
smtpd_tls_ciphers = high
smtpd_tls_key_file = /etc/ssl/certs/.key
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_protocols = TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3
smtpd_tls_protocols = TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
soft_bounce = no
tls_high_cipherlist = 
EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

tls_preempt_cipherlist = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_maps = 
mysql:/etc/postfix/alias.cf,mysql:/etc/postfix/mysql2.cf

virtual_mailbox_domains = mysql:/etc/postfix/mysql1.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql3.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

Re: Problem setting a TLS verified connection

[Bastian Blank]

On Wed, Jun 19, 2019 at 09:28:52PM +0200, sral...@gmail.com wrote:
>  Verified TLS connection established to MXhost[xxx.xxx.xxx.xxx]:25: TLSv1.1
> with cipher ECDHE-RSA-AES256-SHA (256/256 bits)

Postfix: I can verify the certificate of the remote host

> postfix/smtp[]: : to=, relay=MXhost[xxx.xxx.xxx.xxx]:25,
> delay=2190, delays=2186/0.03/3.9/0.13, dsn=4.7.0, status=deferred (host
> MXdomain[xxx.xxx.xxx.xxx] said: 403 4.7.0 not authenticated (in reply to
> MAIL FROM command))

Postfix: The remove host does not like what I send.

This two things have nothing to do with each other.  You obviously lack
authentication, not remote verification.  Please describe your problem,
not your solution.

> relay_domains = 

Syntax error.

> smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, TLSv1.1

Don't.

> smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1

What?

Bastian

-- 
Conquest is easy. Control is not.
-- Kirk, "Mirror, Mirror", stardate unknown

Re: Problem setting a TLS verified connection

[sral...@gmail.com]

El 19/6/19 a las 21:50, Bastian Blank escribió:

On Wed, Jun 19, 2019 at 09:28:52PM +0200, sral...@gmail.com wrote:
 Verified TLS connection established to MXhost[xxx.xxx.xxx.xxx]:25: 
TLSv1.1

with cipher ECDHE-RSA-AES256-SHA (256/256 bits)

Postfix: I can verify the certificate of the remote host

postfix/smtp[]: : to=, 
relay=MXhost[xxx.xxx.xxx.xxx]:25,

delay=2190, delays=2186/0.03/3.9/0.13, dsn=4.7.0, status=deferred (host
MXdomain[xxx.xxx.xxx.xxx] said: 403 4.7.0 not authenticated (in reply to
MAIL FROM command))

Postfix: The remove host does not like what I send.

This two things have nothing to do with each other. You obviously lack
authentication, not remote verification. Please describe your problem,
not your solution.


I'm trying to establish a verified connection between my server and an 
external one.






relay_domains = 

Syntax error.

This is for mailman use.



smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, TLSv1.1

Don't.

Ok, commented.



smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1

What?

Commented.


Bastian

Re: How to tell my ISP there's a problem

[Chris Pollock]

On Tue, 2019-06-18 at 21:15 -0500, Chris Pollock wrote:
> On Tue, 2019-06-18 at 13:29 +1000, Richard James Salts wrote:
> > On Monday, 17 June 2019 7:48:05 PM AEST Chris Pollock wrote:
> > > Apologies if the subject is vague however I'll attempt to explain
> > > further. I run a cron job once a day that updates my Spamassassin
> > > rules. Up until a couple of weeks ago I would get the output of
> > > that
> > > cron job mailed to me. For some reason this is the only cron job
> > > output
> > > that's not coming back. I've determined that size it not a factor
> > > since
> > > some of my hourly logcheck messages are up to 400k if a restart
> > > has
> > > taken place. Below is the output when it was working and the
> > > output
> > > since them. I can't see a difference so it has to be something at
> > > my
> > > ISP with just this one cron job but I can't see it.
> > > 
> > > https://pastebin.com/v0rMErQh
> > > 
> > > Thanks for any suggestions
> > 
> > Maybe it's going to a spam folder. I notice that the reply from
> > your
> > isp says 
> > 250 SPF validation soft failure in both cases, but if they stopped
> > forwarding 
> > "potentially forged" emails that might be a possible cause. It is
> > definitely 
> > the behaviour on smtp.embarqmail.com that has changed though, so
> > you
> > need to 
> > ask the administrators of that server. Is this direct to MX or is
> > it
> > a fixed 
> > relay intended to be a smarthost?
> > 
> 
> I'd been told quite awhile back that the spf soft failure isn't a
> problem by Centurylink  Be that as it may I went into chat with
> Centurylink tech support this afternoon. I had all the information
> that
> I could think of to share with them. After over an hour of trying to
> explain what the problem is I got absolutely no where. In fact the
> 2nd
> person I went into chat with just up and terminated the chat on me
> inJun 19 12:45:03 localhost boinc[1710]: No protocol specified
> the middle of it. I was on the verge of changing my postfix setup to
> use my gmail account when I decided to try one last thing and that
> was
> to change the port from 25 to 587. After updating postfix files and
> reloading postfix I changed the time on the spamassassin update
> cronjob
> and let it run. Amazingly the message I expected was sent and
> received.
> I can only conclude that making the change from port 25 to 587 made
> the
> difference. I'll know for sure tomorrow when the SA-Update cronjob
> runs
> at the regular time. 
> 
> One last item, this isn't a mail server but just my home Ubuntu
> system.
> I've had postfix setup for many years from way back in my Mandrake
> days
> in order to easily send output of cronjobs to myself. It's probably
> overkill but it works fine for me and runs without any problems
> (except
> this last one).
> 
> I'd like thank those that replied.
> 
> Chris

I spoke too soon. Today with the SA-Update message at the normal time
it went out as usual however as has been the case I didn't get it back.
So, I changed the time on the cronjob and ran it again about 45mins
later. This time since there was no update and the message that the
cronjob generated was much smaller it came back. I've posted some more
syslog postfix output on pastebin. One thing I've noticed is that the
original SA-Update cronjob message is forwarded [1] whereas none of the
others aren't. Another thing I noticed is that when there is no update
the message of course is much smaller than when there is one. Update -
size=215160 no update - size=5845 which of course makes sense however
the message with no update output came back as it should have. 

[1] localhost postfix/local[22152]: 7706F10007E7: to=<
root@cpollock.localdomain>, orig_to=, relay=local, delay=0.16,
delays=0.11/0/0/0.05, dsn=2.0.0, status=sent (forwarded as
84C6C10004DC)

I'm pretty sure it's not a file size problem because I just sent myself
a 9Mb file attachment with Evolution and the fact that a logcheck
message handled by postfix after a restart is around 500k. I've been
trying to send a large file with mailx to see if it comes back but nomatter 
what command line options I use no file gets attached. 

mailx -a ~/Downloads/MISSION_Act_Community_Care_Booklet.pdf -s "test" 
cpoll...@embarqmail.com

I've also tried putting the -a after the 'To:' address still doesn't
work. 

https://pastebin.com/wd3QfxJ4


-- 
Chris
KeyID 0xE372A7DA98E6705C
31.11972; -97.90167 (Elev. 1092 ft)
16:54:11 up 1 day, 23:58, 1 user, load average: 0.68, 0.82, 0.71
Description:Ubuntu 18.04.2 LTS, kernel 4.18.0-22-generic


signature.asc
Description: This is a digitally signed message part

Re: Problem setting a TLS verified connection

[Viktor Dukhovni]

On Wed, Jun 19, 2019 at 09:28:52PM +0200, sral...@gmail.com wrote:

> I'm trying to establish smtp_tls_security_level=verify connection with just 
> one domain.
  --
  succeeding
  --

>  From mail.log:
>
> Outgoing message:
> 
>   Verified TLS connection established to MXhost[xxx.xxx.xxx.xxx]:25: 
>  TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)

As plainly evidenced in the log.

>   postfix/smtp[]: : to=, 
> relay=MXhost[xxx.xxx.xxx.xxx]:25, delay=2190, delays=2186/0.03/3.9/0.13, 
> dsn=4.7.0, status=deferred (host MXdomain[xxx.xxx.xxx.xxx] said: 403 
> 4.7.0 not authenticated (in reply to MAIL FROM command))

It is understandably easy to confuse SSL with SASL and authentication
of the server by clients via server certificates, with authentication
of clients by servers via passwors, GSSAPI tokens, client certificates,
etc.  So there you are, confused...

The error message is from the server, which expects your client to
present authentication credentials.  Which ones depends on what
the server operator documents as the expected means for clients
to prove they are one of the ones authorized to access the server.

> smtp_tls_CApath = /etc/ssl/certs

Yes, you need that for "verify" (or "secure", which may be more
appropriate if the server is reached indirectly via insecure MX
lookup).

> smtp_tls_loglevel = 2

That's too verbose for normal operation, "1" is better.

> smtp_tls_mandatory_ciphers = high
> smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, TLSv1.1

The first three are fine, but DO NOT insist on TLSv1.1, rather
either leave it out (enabling it and TLSv1.2 and TLSv1.3 is available),
or also turn it off, since pretty much nobody is using TLSv1.1.  Either
of the below are fine:

smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

> smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1

For opportunistic TLS, I'd be more permissive:

smtp_tls_protocols = !SSLv2,!SSLv3

which is the default in recent Postfix releases.

> smtpd_sasl_auth_enable = yes
> smtpd_sasl_path = private/auth
> smtpd_sasl_type = dovecot

That gives you inbound SASL auth, but nothing outbound towards the
server in question.

> smtpd_tls_loglevel = 2

Again, too verbose.

> smtpd_tls_mandatory_ciphers = high
> smtpd_tls_mandatory_protocols = TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3

Again, use only exclusion:

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3

> smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

With session tickets (Postfix >= 2.10 IIRC), you generally don't
need a server-side cache.

> smtpd_use_tls = yes

The security level setting makes this redundant.

> tls_high_cipherlist = 
> EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

Don't.  The default is fine.

-- 
Viktor.

Re: Mails to gmail bouncing

[Viktor Dukhovni]

On Wed, Jun 19, 2019 at 01:37:41PM +0200, Ralf Hildebrandt wrote:

> First entry for gmail was:
> 
> Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
>   to=,
>   relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25,
>   delay=4.8, delays=3.3/0.04/0.62/0.84, dsn=5.2.2, status=bounced
>   (host gmail-smtp-in.l.google.COM[173.194.76.26] said:
>552 5.2.2 The email account that you tried to reach is over quota. Please 
> direct
>   (in reply to RCPT TO command))
>
> Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
>   host gmail-smtp-in.l.google.COM[173.194.76.26] said:
>   452-4.2.2 the recipient to
>   452 4.2.2 https://support.google.com/mail/?p=OverQuotaTemp w9si551343wmd.47 
> - gsmtp
>   (in reply to RCPT TO command)

There's our "smoking gun"...  The first log message starts with

5525.2.2 ...

and the second with:

4524.2.2

but this is clearly a response for a single recipient, split across
multiple lines.  So now the question is whether Gmail is actually
sending that, or whether something on your side is turning the
initial hyphen into a space.  But I'm puzzled by the second message,
it seems to be missing the "to=", "relay=", ... did you forget to
paste those in?

-- 
Viktor.

Re: Mails to gmail bouncing

[Wietse Venema]

Viktor Dukhovni:
> On Wed, Jun 19, 2019 at 01:37:41PM +0200, Ralf Hildebrandt wrote:
> 
> > First entry for gmail was:
> > 
> > Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
> >   to=,
> >   relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25,
> >   delay=4.8, delays=3.3/0.04/0.62/0.84, dsn=5.2.2, status=bounced
> >   (host gmail-smtp-in.l.google.COM[173.194.76.26] said:
> >552 5.2.2 The email account that you tried to reach is over quota. 
> > Please direct
> >   (in reply to RCPT TO command))

So this is what Google search says:

Specifically, anyone sending email to a user whose Inbox is out
of storage receives a bounce 452-4.2.2 message stating "The
email account that you tried to reach is over quota." In terms
of message delivery, this is a temporary failure, and the sending
server tries to resend later when more storage is available.

Storage limits - G Suite Admin Help - Google Support
https://support.google.com/a/answer/1186436?hl=en

Wietse

> > Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
> >   host gmail-smtp-in.l.google.COM[173.194.76.26] said:
> >   452-4.2.2 the recipient to
> >   452 4.2.2 https://support.google.com/mail/?p=OverQuotaTemp 
> > w9si551343wmd.47 - gsmtp
> >   (in reply to RCPT TO command)
> 
> There's our "smoking gun"...  The first log message starts with
> 
>   5525.2.2 ...
> 
> and the second with:
> 
>   4524.2.2
> 
> but this is clearly a response for a single recipient, split across
> multiple lines.  So now the question is whether Gmail is actually
> sending that, or whether something on your side is turning the
> initial hyphen into a space.  But I'm puzzled by the second message,
> it seems to be missing the "to=", "relay=", ... did you forget to
> paste those in?
> 
> -- 
>   Viktor.
> 

Re: Mails to gmail bouncing

[Wietse Venema]

Wietse Venema:
> Viktor Dukhovni:
> > On Wed, Jun 19, 2019 at 01:37:41PM +0200, Ralf Hildebrandt wrote:
> > 
> > > First entry for gmail was:
> > > 
> > > Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
> > >   to=,
> > >   relay=gmail-smtp-in.l.google.COM[173.194.76.26]:25,
> > >   delay=4.8, delays=3.3/0.04/0.62/0.84, dsn=5.2.2, status=bounced
> > >   (host gmail-smtp-in.l.google.COM[173.194.76.26] said:
> > >552 5.2.2 The email account that you tried to reach is over quota. 
> > > Please direct
> > >   (in reply to RCPT TO command))
> 
> So this is what Google search says:
> 
> Specifically, anyone sending email to a user whose Inbox is out
> of storage receives a bounce 452-4.2.2 message stating "The
> email account that you tried to reach is over quota." In terms
> of message delivery, this is a temporary failure, and the sending
> server tries to resend later when more storage is available.
> 
> Storage limits - G Suite Admin Help - Google Support
> https://support.google.com/a/answer/1186436?hl=en

Ralf, you need to fix your smtp_reply_filter :-( You replace "452-"
with "552 ", and break one multiline response into two responses.
We can help if you share the regexp.

Wietse
> 
> > > Jun 19 09:52:42 mail-cvk postfix/smtp[32063]: 45THH93PXyz1Z4Kq:
> > >   host gmail-smtp-in.l.google.COM[173.194.76.26] said:
> > >   452-4.2.2 the recipient to
> > >   452 4.2.2 https://support.google.com/mail/?p=OverQuotaTemp 
> > > w9si551343wmd.47 - gsmtp
> > >   (in reply to RCPT TO command)
> > 
> > There's our "smoking gun"...  The first log message starts with
> > 
> > 5525.2.2 ...
> > 
> > and the second with:
> > 
> > 4524.2.2
> > 
> > but this is clearly a response for a single recipient, split across
> > multiple lines.  So now the question is whether Gmail is actually
> > sending that, or whether something on your side is turning the
> > initial hyphen into a space.  But I'm puzzled by the second message,
> > it seems to be missing the "to=", "relay=", ... did you forget to
> > paste those in?
> > 
> > -- 
> > Viktor.
> > 
>