ConfigServer Community Forum

Hi

I am running mailscanner latest version 4.71.10-1 with clamav-2.94 at my cpanel server. recently i am seeing sometimes mail is not reaching the mailbox. seeing the log in exim_mainlog that one user of a domain has sent a mail to another user of same domain but mail is not delivered in the mailbox. more or less this type of problem happening sometimes not frequently and its happening only users of same domain. if mail is not delivered to mailbox where this mail is disappearing. is there any way to find out where this mail is disappearing. i contacted with cpanel regarding this issue they told that its mailscanner issue. can you please suggest how can we overcome this situation if we face such problem.here i am giving you a log file as an example from /var/log/exim_mainlog

2008-09-24 16:05:42 [24894] 1KiRFe-0006TW-ID <= mithu@immaculateltd.com H=(mithu
) [202.22.193.39]:1683 I=[202.22.192.1]:25 P=smtp S=1365 id=001001c91e2e$2b92f53
0$0200a8c0@mithu T="test message" from <mithu@immaculateltd.com> for iftikhar@im
maculateltd.com

2008-09-23 13:50:59 [4912] 1Ki2fj-0001HE-CW <= jakir@kjfashionbd.com H=fw1.accesstel.net (CallCenter1) [202.22.192.29]:3944 I=[202.22.192.1]:25 P=smtp S=1412 id=002601c91d52$2b41b4e0$3a50a8c0@CallCenter1 T="Test" from <jakir@kjfashionbd.com> for jakir@kjfashionbd.com

Often when this type of thing happens it is because the sender's IP address is listed on one of the RBL lists used in MailScanner, AND the domain has MailScanner configured to delete high-scoring spam. I assume you don't have MailWatch installed, so to investigate it you will need to change the high-scoring spam action for the affected domains from delete to deliver and check the headers if emails that are sent within the domain are marked as {Definitely Spam?}.

if its the case that RBL is blocking that domain or sender email and due to high scoring spam mail is being deleted, then how same sender able to send mail to same user under same domain while sending next time. i am realy confused. please suggest is there any way to install tailwatch at cpanel server to diagnosis such problem

I have no idea. If the user is on a dialup perhaps the IP address changes from time to time, or perhaps their IP address gets removed from the blacklist and then re-added. Have you checked the headers as I suggested? If it's MailScanner that is deleting the mails, then looking at the exim logs won't help. if it's exim that's doing it, then you can search the exim logs. You need to look at both to determine what is happening. Whether tailwatch is installed is dependent on what version of cPanel you are running, and tailwatch will not make any difference in what is logged in the exim logs.

i am running cpanel version WHM 11.23.2 cPanel 11.23.6-R27698 and also tailwatch is running at cpanel server. if mailscanner is deleting any mail how can i ensure by tailwatch log. can you help in this regard?

This FAQ should help. The logs produced by exim are the same whether your server is running tailwatch or not.

http://www.configserver.com/techfaq/index.php?faqid=59

Regards,
Sarah