Does sendmail sometimes NOT receive?

dougp23 · 04-16-2008, 07:26 PM

I have one user who says jsmith@blowhard.com emailed her, and she never got the message. For awhile, I had SpamAssassin running pretty tight, so occasionally messages were being rejected by SA. However, for this message:

there is no evidence of it /var/log/maillog
The sending user never got a NDR or bounce.

Is this common? My maillog is loaded with messages, I could recreate entire weeks! I mean, how possible is it that sendmail ignored this one message, or was offline or something at that time (like the ISP was down or something)??

I am asking the IT guy at jsmith's shop to check his logs and make sure they actually DID send the message to me. So the short question is: if it's not in /var/log/maillog, and i see no signs that sendmail was down at that time, how likely is it that the problem is on THEIR end??
And are there other places I should check on my system?

gilead · 04-16-2008, 07:44 PM

I don't know of any cases of sendmail doing that without logging - but I have seen SpamAssassin do it when messages higher than a particular score get sent to /dev/null. I'd be looking at it as their problem unless they can give dates/times and the address they sent it to was confirmed as correct.

eaglek96 · 04-16-2008, 08:51 PM

The only thing I can think of is that the message was thrown out due to a blacklist and the rejection is only being logged in /var/log/maillog as a source IP. You wouldn't see the sender's email address since it isn't relevant when SPAMAssasin is looking at RBL's.

Maybe look for the IP of blowhard.com rather than the source domain name/email address?

vedang · 04-16-2008, 11:44 PM

Hi,

First thing is that sendmail logs any kind of mail related activity to the /var/log/maillog. Let it it be forwarding a mail to another id, Deleting the mail, Sending a mail , Receiving a mail or sending a mail to /dev/null or any other.
If the user was supposed to receive a mail from jsmith@blowhard.com, and the mail is deleted any how, it will definitely log it to /var/log/maillog.
And if there is no entry in logs for that mail, there is a strong possibility that mail is actually not sent or it is vanished in between in the network transmission.

dougp23 · 04-17-2008, 07:19 AM

Quote:

Originally Posted by vedang

Hi,

First thing is that sendmail logs any kind of mail related activity to the /var/log/maillog. Let it it be forwarding a mail to another id, Deleting the mail, Sending a mail , Receiving a mail or sending a mail to /dev/null or any other.
If the user was supposed to receive a mail from jsmith@blowhard.com, and the mail is deleted any how, it will definitely log it to /var/log/maillog.
And if there is no entry in logs for that mail, there is a strong possibility that mail is actually not sent or it is vanished in between in the network transmission.

This is kind of where I am leaning. Either it vanished, or they never sent it. I have asked their IT shop to prove it was sent. I am checking with my support vendor to see if he is "secondary mail spooling" (I don't know the proper term) for me (i.e. he is listed as 2nd MX for my domain). My thought is that MAYBE, my mailserver refused connections for a time, and the msg went to 2nd MX, and the 2nd MX did not fwd the message on to me. I see no downtime for Sendmail, so still waiting for the other party to reply.

Doug