Emails not received from specific sender

[mhmd]

Hi all,

I have a reception problem with a specific sender on my PMG installation.
Emails from a sender are not sent to my MS Exchange server.
I don't know why the connection is lost after exactly 1 minute.
I cannot have any log or information from the sender because its a big company.
No problem with other 99,99% of incoming emails.
I have enabled debug mode 3 for this sender and past log here :

Nov 18 17:12:00 pmg postfix/postscreen[53328]: CONNECT from [***SENDER_PUBLIC_IP***]:60180 to [***MS_EXCHANGE_IP***]:25 Nov 18 17:12:00 pmg postfix/postscreen[53328]: WHITELISTED [***SENDER_PUBLIC_IP***]:60180 Nov 18 17:12:00 pmg postfix/postscreen[53328]: CONNECT from [***SENDER_PUBLIC_IP***]:60181 to [***MS_EXCHANGE_IP***]:25 Nov 18 17:12:00 pmg postfix/postscreen[53328]: WHITELISTED [***SENDER_PUBLIC_IP***]:60181 Nov 18 17:12:00 pmg postfix/postscreen[53328]: CONNECT from [***SENDER_PUBLIC_IP***]:60182 to [***MS_EXCHANGE_IP***]:25 Nov 18 17:12:00 pmg postfix/postscreen[53328]: WHITELISTED [***SENDER_PUBLIC_IP***]:60182 Nov 18 17:12:00 pmg postfix/postscreen[53328]: CONNECT from [***SENDER_PUBLIC_IP***]:60183 to [***MS_EXCHANGE_IP***]:25 Nov 18 17:12:00 pmg postfix/postscreen[53328]: WHITELISTED [***SENDER_PUBLIC_IP***]:60183 Nov 18 17:12:00 pmg postfix/smtpd[53313]: connect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:12:00 pmg postfix/smtpd[53313]: smtp_stream_setup: maxtime=300 enable_deadline=0 Nov 18 17:12:00 pmg postfix/smtpd[53313]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53313]: name_mask: silent-discard Nov 18 17:12:00 pmg postfix/smtpd[53313]: name_mask: dsn Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 220 ***PMG_DOMAIN_NAME*** ESMTP Proxmox Nov 18 17:12:00 pmg postfix/smtpd[53313]: watchdog_pat: 0x563a19aacf20 Nov 18 17:12:00 pmg postfix/smtpd[53313]: vstream_fflush_some: fd 13 flush 31 Nov 18 17:12:00 pmg postfix/smtpd[53297]: connect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:12:00 pmg postfix/smtpd[53297]: smtp_stream_setup: maxtime=300 enable_deadline=0 Nov 18 17:12:00 pmg postfix/smtpd[53297]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53297]: name_mask: silent-discard Nov 18 17:12:00 pmg postfix/smtpd[53297]: name_mask: dsn Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 220 ***PMG_DOMAIN_NAME*** ESMTP Proxmox Nov 18 17:12:00 pmg postfix/smtpd[53297]: watchdog_pat: 0x5622da61ef20 Nov 18 17:12:00 pmg postfix/smtpd[53297]: vstream_fflush_some: fd 13 flush 31 Nov 18 17:12:00 pmg postfix/smtpd[53340]: connect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:12:00 pmg postfix/smtpd[53340]: smtp_stream_setup: maxtime=300 enable_deadline=0 Nov 18 17:12:00 pmg postfix/smtpd[53340]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53340]: name_mask: silent-discard Nov 18 17:12:00 pmg postfix/smtpd[53340]: name_mask: dsn Nov 18 17:12:00 pmg postfix/smtpd[53340]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 220 ***PMG_DOMAIN_NAME*** ESMTP Proxmox Nov 18 17:12:00 pmg postfix/smtpd[53340]: watchdog_pat: 0x556fb2622f20 Nov 18 17:12:00 pmg postfix/smtpd[53340]: vstream_fflush_some: fd 19 flush 31 Nov 18 17:12:00 pmg postfix/smtpd[53297]: vstream_buf_get_ready: fd 13 got 26 Nov 18 17:12:00 pmg postfix/smtpd[53313]: vstream_buf_get_ready: fd 13 got 26 Nov 18 17:12:00 pmg postfix/smtpd[53313]: < ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: EHLO ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53297]: < ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: EHLO ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53313]: match_list_match: ***SENDER_DOMAIN_NAME***: no match Nov 18 17:12:00 pmg postfix/smtpd[53297]: match_list_match: ***SENDER_DOMAIN_NAME***: no match Nov 18 17:12:00 pmg postfix/smtpd[53313]: match_list_match: ***SENDER_PUBLIC_IP***: no match Nov 18 17:12:00 pmg postfix/smtpd[53297]: match_list_match: ***SENDER_PUBLIC_IP***: no match Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-***PMG_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-***PMG_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-PIPELINING Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-PIPELINING Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-SIZE Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-SIZE Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-VRFY Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-VRFY Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-ETRN Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-ETRN Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-STARTTLS Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-STARTTLS Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-ENHANCEDSTATUSCODES Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-ENHANCEDSTATUSCODES Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-8BITMIME Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-8BITMIME Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-SMTPUTF8 Nov 18 17:12:00 pmg postfix/smtpd[53313]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250 CHUNKING Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250-SMTPUTF8 Nov 18 17:12:00 pmg postfix/smtpd[53313]: watchdog_pat: 0x563a19aacf20 Nov 18 17:12:00 pmg postfix/smtpd[53297]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 250 CHUNKING Nov 18 17:12:00 pmg postfix/smtpd[53313]: vstream_fflush_some: fd 13 flush 144 Nov 18 17:12:00 pmg postfix/smtpd[53297]: watchdog_pat: 0x5622da61ef20 Nov 18 17:12:00 pmg postfix/smtpd[53297]: vstream_fflush_some: fd 13 flush 144 Nov 18 17:12:00 pmg postfix/smtpd[53341]: connect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:12:00 pmg postfix/smtpd[53341]: smtp_stream_setup: maxtime=300 enable_deadline=0 Nov 18 17:12:00 pmg postfix/smtpd[53341]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:12:00 pmg postfix/smtpd[53341]: name_mask: silent-discard Nov 18 17:12:00 pmg postfix/smtpd[53341]: name_mask: dsn Nov 18 17:12:00 pmg postfix/smtpd[53341]: > ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***]: 220 ***PMG_DOMAIN_NAME*** ESMTP Proxmox Nov 18 17:12:00 pmg postfix/smtpd[53341]: watchdog_pat: 0x564764ff7f20 Nov 18 17:12:00 pmg postfix/smtpd[53341]: vstream_fflush_some: fd 19 flush 31 Nov 18 17:12:45 pmg pmg-smtp-filter[45885]: starting database maintenance Nov 18 17:12:45 pmg pmg-smtp-filter[45885]: end database maintenance (13 ms) Nov 18 17:13:00 pmg postfix/smtpd[53297]: smtp_get: EOF Nov 18 17:13:00 pmg postfix/smtpd[53297]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:13:00 pmg postfix/smtpd[53297]: lost connection after EHLO from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:13:00 pmg postfix/smtpd[53297]: disconnect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] ehlo=1 commands=1 Nov 18 17:13:00 pmg postfix/smtpd[53297]: name_mask: no_address_mappings Nov 18 17:13:00 pmg postfix/smtpd[53340]: smtp_get: EOF Nov 18 17:13:00 pmg postfix/smtpd[53340]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:13:00 pmg postfix/smtpd[53340]: lost connection after CONNECT from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:13:00 pmg postfix/smtpd[53340]: disconnect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] commands=0/0 Nov 18 17:13:00 pmg postfix/smtpd[53340]: name_mask: no_address_mappings Nov 18 17:13:00 pmg postfix/smtpd[53341]: smtp_get: EOF Nov 18 17:13:00 pmg postfix/smtpd[53341]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:13:00 pmg postfix/smtpd[53341]: lost connection after CONNECT from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:13:00 pmg postfix/smtpd[53341]: disconnect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] commands=0/0 Nov 18 17:13:00 pmg postfix/smtpd[53341]: name_mask: no_address_mappings Nov 18 17:13:00 pmg postfix/smtpd[53313]: smtp_get: EOF Nov 18 17:13:00 pmg postfix/smtpd[53313]: match_hostname: smtpd_client_event_limit_exceptions: ***SENDER_DOMAIN_NAME*** ~? ***SENDER_DOMAIN_NAME*** Nov 18 17:13:00 pmg postfix/smtpd[53313]: lost connection after EHLO from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] Nov 18 17:13:00 pmg postfix/smtpd[53313]: disconnect from ***SENDER_DOMAIN_NAME***[***SENDER_PUBLIC_IP***] ehlo=1 commands=1 Nov 18 17:13:00 pmg postfix/smtpd[53313]: name_mask: no_address_mappings

Some log informations (ips and domains names) have been replaced by ***XXX***.
Please let me know if you need some specific information.

Thank you for your help.

 

[Stoiko Ivanov]

With the replacements and the verbose logging it's quite hard to get an overview ... but:

lost connection after CONNECT from

seems like the sending server simply disconnected.
This can have multiple reasons:
* something it the sending server config decided it should not continue
* some router/firewall on the network decided to drop the connection

in any case it's usually the quickest to ask the sending server what their logs say - or tell them that their server drops the connection
(they do have an interest in sending mail usually)

 

[mhmd]

Please let me know if you need some specific information.
No router between PMG and Exchange server (they are in the same local network)
On sender side, emails are sent automatically by a service (it's a report email with an attachement).
So, its very difficult to have the returned email (if exist).
If I add my private gmail email in cc, I receive the email imediatelly.

 

[Stoiko Ivanov]

On sender side, emails are sent automatically by a service (it's a report email with an attachement).

does the service maybe create some logs, which might indicate where the problem is?
If not - how does it send mails - it might be a workaround to have it send the mails using an MTA on the sending server (in case it tries to directly connect to port 25 of PMG) - then you would also have some logs to work with?

CONNECT from [***SENDER_PUBLIC_IP***]:60180 to [***MS_EXCHANGE_IP***]:25

this line from the logs you posted seems odd?
it seems that MS_EXCHANGE_IP should be your PMG IP?!

 

[mhmd]

Unfortunately, no logs are available and I don't know how they send their email.

Exact, I make a mistake, it's my PMG_IP, not my MS_EXCHANGE_IP.

CONNECT from [***SENDER_PUBLIC_IP***]:60180 to [***PMG_LOCAL_IP***]:25

I just make another test : if I add in cc another email (email with an auto-forward to an email from my Exchange server), email is received (so accepted by PMG).

 

[Stoiko Ivanov]

As said - to me this looks like the sending server/script/... drops the connection - the logs don't say why

one thing you could still try is to let the script send the mail to the internal port of PMG (the sending server needs to be in your trusted networks) - as there fewer checks are being done (you could also to the redirect in the firewall in front of PMG (or in PMG itself)

else I currently do not think this is an issue with PMG/postfix

 

[mhmd]

exact, i just need the reason to understand why connection is lost.
If you are talking about the whitelist in mail proxy configuration (IP address sender), it's the first thing I did ?

i want to be agree with you but i don't understand why i don't receive the email but my private gmail do.

 

[Stoiko Ivanov]

exact, i just need the reason to understand why connection is lost.

As said - from the quick check - you need to consult the logs of the sending script/sender to get more information

f you are talking about the whitelist in mail proxy configuration (IP address sender), it's the first thing I did ?

no I'm taking about the internal port - where internal mail should be sent to PMG for processing - this defaults to port 26:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#firewall_settings

my current (far fetched) guess is that the sending software cannot handle the protocol checks done by postscreen, thus aborts:
https://www.postfix.org/POSTSCREEN_README.html

You can either configure the sending software to send to your PMG on port 26 (and open all relevant firewall settings, and add the IP as trusted network), or configure a port-redirect from the sending IP (and still add it as trusted network)

I hope this explains it

 

[mhmd]

I received information from sender. They get a time out while performing the EHLO handshake

View attachment 47352

I also make sereval tests :

1. If I bypass my PMG server and expose directly my Exchange server, I receive the email.
2. If I copy my PMG server to another VM and configure CyberPanel behind, i receive the email.

PMG server work with CyberPanel ( but not with Exchange server) and email can be received directly to my exchange server (bypassing PMG server).
I dont understant why they dont want to work together with this specific sender.

 

[Stoiko Ivanov]

They get a time out while performing the EHLO handshake

Maybe a firewall on the path between you and the sender blocks the connections from/to PMG
is the second VM (with Cyberpanel behind it) on the same network as the one with Exchange?
is something different in the configuration?

 

[mhmd]

Maybe a firewall on the path between you and the sender blocks the connections from/to PMG

I dont think because when I bypass the PMG server, the email is received.

is the second VM (with Cyberpanel behind it) on the same network as the one with Exchange?

Yes the same network behind the same firewall.

is something different in the configuration?

its exactly the same configuration. I have cloned (backup and restauration in PVE) the PMG server. The only change is the ip adress