Sendmail Milter problem

snorket27 · 02-01-2011, 10:54 PM

Hello,

I have a CentOS server running sendmail 8.14.4. Lately one user has trouble getting his mail. It happens rarely but some of that mail is pretty important.

I checked the sendmail logs and I see this line:

Jan 11 01:29:57 mailsvr02 sendmail[21679]: p0AHTuQ5021679: Milter delete: rcpt user@email.com

The server is installed with Sophos Puremessage, but after putting in a support call, Sophos support assures me that puremessage is not the one deleting the recipient.

Checked through sendmail config but can't find anything that could be the cause, but I'm no sendmail expert. The user can receive most emails, it just happens to some emails. The problem only occurs with mail sent to multiple receipients, of which the user is one. All other recipients get the mail with no trouble.

Even weirder still, sometimes after the recipient is deleted from a message, a few seconds later there is another message with the exact same message id but having the previously deleted user's email address as the only recipient.

Any suggestions would be much appreciated.

snorket27 · 02-06-2011, 08:13 PM

Anybody? Looks like this is a real puzzler...

Noway2 · 02-07-2011, 05:14 AM

Quote:

Jan 11 01:29:57 mailsvr02 sendmail[21679]: p0AHTuQ5021679: Milter delete: rcpt user@email.com

This message is saying that your mail filter took action on the message and I am guessing it is because of something in the rcp to.

Quote:

The problem only occurs with mail sent to multiple receipients, of which the user is one.

Look at the list VERY closely. Is there anything different, such as a missing punctuation mark before or after, a misspelling, missing or added <>, or even non printable characters in the name? Do it happen with a particular list or from a particular address book? There has to be something in this recipient's information that is triggering the filter.

Quote:

Sophos support assures me that puremessage is not the one deleting the recipient.

Ok, are there reasonable facts to back this assertion up? Are you using any other filters?

Quote:

sometimes after the recipient is deleted from a message, a few seconds later there is another message with the exact same message id but having the previously deleted user's email address as the only recipient

Look at this message very closely. I suspect it is a form of quarantine notification that is supposed to go to the system administrator. This message could have important clues as to why the original message was flagged. The header information you are seeing could very well be identification information pointing to the original message, not a resend with the same ID.

snorket27 · 02-08-2011, 01:59 AM

Thanks Noway2! I did check if there was anything wrong with the address, but I will follow your suggestions and see if I an find any clues.

Is there a way I can check the presence of another filter? As far as I know, puremessage should be the only filter.