mailer-daemon mails are in queue

[kcizmesija]

First of all hello everybody. As I was checking queue inside of my proxmox mail gateway, I have seen that I have like 30 mails which are just hanging there.
All mails are from MAILER-DAEMON@my-domain.com to system@webuntis.com. Reason is "connect to hermes.webuntis.com [213.208.138.150]:25: Connection timed out".
I think that the email address system@webuntis.com is not configured to receive emails. Because it is some kind of noreply email address.
So, my question is if there is any way to block this action. I already tried with Mail Filter where i made outgoing rule which said all mails from MAILER-DAEMON@my-domain.com to system@webuntis.com should be blocked. But it doesn't seem to work because I still get those mails stacked up in my queue.
Does anybody know what could I do to stop this behavior? And if any kind of info about system or something else is needed I could provide it.
Thans in advance.

 

[Stoiko Ivanov]

please share the logs of such a mail - also check the logs for mails from system@webuntis.com

 

[kcizmesija]

Jan 18 08:23:27 lupfen postfix/smtpd[1534482]: connect from hermes.webuntis.com[213.208.138.150]
Jan 18 08:23:27 lupfen postfix/smtpd[1534482]: Anonymous TLS connection established from hermes.webuntis.com[213.208.138.150]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)
Jan 18 08:23:27 lupfen postfix/smtpd[1534482]: NOQUEUE: client=hermes.webuntis.com[213.208.138.150]
Jan 18 08:23:27 lupfen pmg-smtp-filter[1535060]: 30225165A8D1EF9C01B: new mail message-id=<857986619.432048.1705562606540@hermes.webuntis.com>#012
Jan 18 08:23:28 lupfen pmg-smtp-filter[1535060]: 30225165A8D1EF9C01B: SA score=0/5 time=0.467 bayes=0.00 autolearn=no autolearn_force=no hits=BAYES_00(-1.9),DMARC_MISSING(0.1),HTML_MESSAGE(0.001),HTML_MIME_NO_HTML_TAG(0.377),KAM_DMARC_STATUS(0.01),MIME_HTML_ONLY(0.1),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_SCC_BODY_TEXT_LINE(-0.01)
Jan 18 08:23:28 lupfen postfix/smtpd[1534164]: connect from localhost.localdomain[127.0.0.1]
Jan 18 08:23:28 lupfen postfix/smtpd[1534164]: 247A8303676: client=localhost.localdomain[127.0.0.1], orig_client=hermes.webuntis.com[213.208.138.150]
Jan 18 08:23:28 lupfen postfix/cleanup[1534667]: 247A8303676: message-id=<857986619.432048.1705562606540@hermes.webuntis.com>
Jan 18 08:23:28 lupfen postfix/qmgr[3119545]: 247A8303676: from=<system@webuntis.com>, size=1814, nrcpt=1 (queue active)
Jan 18 08:23:28 lupfen postfix/smtpd[1534164]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
Jan 18 08:23:28 lupfen pmg-smtp-filter[1535060]: 30225165A8D1EF9C01B: accept mail to <mail@example.com> (247A8303676) (rule: default-accept)
Jan 18 08:23:28 lupfen pmg-smtp-filter[1535060]: 30225165A8D1EF9C01B: processing time: 0.554 seconds (0.467, 0.029, 0)
Jan 18 08:23:28 lupfen postfix/smtpd[1534482]: proxy-accept: END-OF-MESSAGE: 250 2.5.0 OK (30225165A8D1EF9C01B); from=<system@webuntis.com> to=<mail@example.com> proto=ESMTP helo=<hermes.webuntis.com>
Jan 18 08:23:28 lupfen postfix/smtpd[1534482]: disconnect from hermes.webuntis.com[213.208.138.150] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Jan 18 08:23:28 lupfen postfix/smtp[1533735]: Untrusted TLS connection established to 185.61.28.146[185.61.28.146]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits)
Jan 18 08:23:28 lupfen postfix/smtp[1533735]: 247A8303676: to=<mail@example.com>, relay=185.61.28.146[185.61.28.146]:25, delay=0.48, delays=0.04/0/0.39/0.04, dsn=2.0.0, status=sent (250 Ok)
Jan 18 08:23:28 lupfen postfix/qmgr[3119545]: 247A8303676: removed

I'm not sure if I understood it correctly, but this is log that was in Tracking Center. This was one mail that came from system@webuntis.com to email address that is behind proxmox mail gateway. I hope you understand but I changed this email address with mail@example.com because of data protection of this person. And also, when I search in my Tracking Center for receiver system@webuntis.com, it says "No data in database". And when I try to search Tracking Center for sender MAILER-DAEMON@my-domain.com, I can't find anything. If this is not enough, tell me what else you specifically need. Thanks in advance.

 

[Stoiko Ivanov]

And when I try to search Tracking Center for sender MAILER-DAEMON@my-domain.com, I can't find anything. If this is not enough, tell me what else you specifically need. Thanks in advance.

Where exactly do you see the mails then? - where is MAILER-DAEMON@my-domain.com written?
usually those mails have an empty envelope sender and only have MAILER-DAEMON@ in the message-headers

 

[kcizmesija]

So this is where I see those mails. And my-domain.com is domain of my proxmox mail gateway. So if I understand it correctly my proxmox mail gateway is trying to send e-mail from MAILER-DAEMON@my-domain.com to system@webuntis.com.



So all the blank places are my-domain.com and this is also domain of my proxmox mail gateway as mentiond above.

I hope this clarifys things a little bit.

 

[Stoiko Ivanov]

Please check the logs directly - /var/log/syslog (or journalctl) - for messages to webuntis.com.

my guess is that PMG (or your downstream server) generates bounces, because the mail did not get delivered

in any case these messages will be dropped after 5 days (postfix queue_lifetime parameter) unless the mailserver for webuntis.com becomes reachable again.

 

[kcizmesija]

In logs are same messages "Connection timed out". Only connection that works is from webuntis.com to PMG. As I said I think webuntis.com is just configured to send mails and not to receive them and that is why MAILER-DAEMON gets connection timed out.

So, it is fine if those emails stack up in queue and I just wait 5 days till they disappear?

 

[Stoiko Ivanov]

In logs are same messages "Connection timed out". Only connection that works is from webuntis.com to PMG. As I said I think webuntis.com is just configured to send mails and not to receive them and that is why MAILER-DAEMON gets connection timed out.

If you cannot share the complete logs from the syslog - it's really not possible to give you more pointers at what exactly is happening and why these mails to webuntis.com are sent by something in your mail-chain...

So, it is fine if those emails stack up in queue and I just wait 5 days till they disappear?

as said - mails are retried for 5 days on temporary errors (connection timeouts are temporary errors) then dropped

 

[kcizmesija]

Ohh sorry I forgot to put attachment of my logs. So, I did cat /var/log/syslog | grep webuntis.com.
This is what I've got from the logs.

 

[tarocjsu]

No any progress ?