Exim keeps sending the same mail

Leap · Dec 21, 2020

Recently a client notified me of a mail that keeps sending if not deleted.
Since it happened multiple times (with different clients) on one of our servers.

Outlook reports the message is not sent, so it keeps trying every 2 minutes.
The message however is sent...

Code:

2020-12-21 13:54:31 1krKhr-0007l2-3h <= FROMMAIL H=FROMHERE (wkst00003) [FROMHEREIP] P=esmtpsa X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=login:FROMMAIL S=2680 id=00da01d6d798$6bff42a0$43fdc7e0$@DOMAIN T="test1" from <FROMMAIL> for TOMAIL
2020-12-21 13:55:50 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1krKhr-0007l2-3h
2020-12-21 13:55:53 1krKhr-0007l2-3h => TOMAIL F=<FROMMAIL> R=lookuphost T=remote_smtp S=2811 H=mx1.mail-scanner.eu [2a00:d10:1141:3::10] X=TLS1.2:AES128-GCM-SHA256:128 CV=yes C="250 OK id=1krKj9-000Ngi-Bp"
2020-12-21 13:55:53 1krKhr-0007l2-3h Completed

I've tried several things, none seem to work...
I'm out of ideas of where to look...

floyd · Dec 21, 2020

Leap said:
Outlook

That says it all. Piece of crap software.

Richard G · Dec 21, 2020

floyd said:
Piece of crap software.

BS. These kind of errors can happen with any software. I'm using it for 12 years, 2003 and 2013, never had an issue. Well... a small one easily fixed.

Since it happened multiple times (with different clients)

Do all those clients use the same Outlook versions? Different clients are different customers or different mail clients?

floyd · Dec 21, 2020

Emails stuck in the outbox is a classic Outlook problem. I have never seen this with any other email program. But I haven't been doing it as long as Richard.

Richard G · Dec 21, 2020

floyd said:
Emails stuck in the outbox is a classic Outlook problem.

Correct. But in those cases they are mostly really stuck, so not send instead of repeatedly send.
Every mail clients has certain issues.

P.s. I would never declare that Outlook or any other program is without flaws. Every OS en software has some. I just don't like to call them crappy if in most cases they work fine.

Leap · Dec 22, 2020

I agree, Outlook is crappy at best some times. However the problem is solved by restarting Exim. So it looks more like an Exim issue then an Outlook one. Also it happens on only one of our several servers.

I don't know if the Outlook versions are the same but they might be.
I can reproduce the issue if they notify me that there is an issue, however not with every mailbox.
We sent our corporate mail through the same server (our Exchange server uses that server as SMTP) without issues, however another SMTP account on the same server does have issues...

It is very strange, any ideas where to start looking?

Richard G · Dec 22, 2020

Leap said:
It is very strange, any ideas where to start looking?

Indeed very odd. Since the same happens on an Exchange server I hardly think it can be an Outlook think.

No clue on what it is, but I would start to rebuild Exim and dovecot on that server, just to be sure.

Leap · Dec 22, 2020

It does not happen if we sent through Exchange...

Rebuilding Exim and dovecot is a start, gonna try it...

Leap · Feb 1, 2021

I've since rebuild exim and dovecot and the problem persists...
Every time it happens something stands out...
I don't know if it is relevant...

Code:

# service exim status
Redirecting to /bin/systemctl status exim.service
● exim.service - Exim Mail Transport Agent
   Loaded: loaded (/etc/systemd/system/exim.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2021-01-26 10:27:10 CET; 6 days ago
 Main PID: 28590 (exim)
   CGroup: /system.slice/exim.service
           └─28590 /usr/sbin/exim -bd -q1h

Feb 01 12:15:57 webmakers04.dewebmakers.nl spamc[16430]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:17:55 webmakers04.dewebmakers.nl spamc[16589]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:26:04 webmakers04.dewebmakers.nl spamc[17292]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:26:18 webmakers04.dewebmakers.nl spamc[17323]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:30:13 webmakers04.dewebmakers.nl spamc[17717]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:31:37 webmakers04.dewebmakers.nl spamc[17824]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:33:26 webmakers04.dewebmakers.nl spamc[17974]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:39:08 webmakers04.dewebmakers.nl spamc[18423]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 12:52:49 webmakers04.dewebmakers.nl spamc[19515]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Feb 01 13:02:56 webmakers04.dewebmakers.nl spamc[20378]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused

The spamd error seems to always be there when is is not working...
Any ideas?

Leap · Feb 1, 2021

By the way, I've got the issue on three machines now...
The annoyance level is starting to rise...

floyd · Feb 1, 2021

Leap said:
I agree, Outlook is crappy at best some times. However the problem is solved by restarting Exim. So it looks more like an Exim issue then an Outlook one. Also it happens on only one of our several servers.

I think Outlook is not telling Exim that its done. That's why restarting Exim fixes it.

Also maybe spamd is hanging and again restarting Exim would fix it because it restarts spamd.

Leap · Feb 1, 2021

Yeah, but that doesn't solve the underlying issue...
I can keep restarting exim every couple of days but I would prefer a more permanent solution...

floyd · Feb 1, 2021

I did not suggest that the solution is restarting exim. I gave you other things to look at.

Leap · Feb 1, 2021

Okay, any idea why of how to check why spamd is hanging?

toml · Feb 1, 2021

It looks to me like exim is trying to connect to spamd via IPv6, and nothing is listening on that port. Do you have spamd listening on a local IPv6 port?

Leap · Feb 1, 2021

How should I check that?
I just installed it through custombuild 2.0,

Does this help?

Code:

# ps aux|grep -in spamd
142:root      1151  0.0  4.3 322076 88848 ?        Ss   14:14   0:02 /usr/bin/perl -T -w /usr/bin/spamd --pidfile /var/run/spamd.pid -d -c -m 15 --ipv4
147:root      2314  0.0  5.0 335804 102836 ?       S    14:14   0:08 spamd child
148:root      2315  0.0  4.2 322076 86180 ?        S    14:14   0:00 spamd child
213:root     11750  0.0  0.0 110804   920 pts/0    S+   16:33   0:00 grep --color=auto -in spamd

toml · Feb 1, 2021

try doing:

Code:

netstat -anp |grep LISTEN
[root@moe rspamd]# netstat -anp |grep LIST
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      16119/exim         
tcp        0      0 50.3.200.238:53         0.0.0.0:*               LISTEN      19706/named         
...     
tcp        0      0 127.0.0.1:11332         0.0.0.0:*               LISTEN      24401/rspamd: main 
tcp        0      0 127.0.0.1:11333         0.0.0.0:*               LISTEN      24401/rspamd: main 
tcp        0      0 127.0.0.1:11334         0.0.0.0:*               LISTEN      24401/rspamd: main 
...      
tcp6       0      0 :::21                   :::*                    LISTEN      12158/pure-ftpd     
tcp6       0      0 :::22                   :::*                    LISTEN      11879/sshd         
tcp6       0      0 :::6010                 :::*                    LISTEN      31144/sshd: tpl@pts
tcp6       0      0 :::3306                 :::*                    LISTEN      12177/mysqld       
tcp6       0      0 :::2222                 :::*                    LISTEN      14648/directadmin   
tcp6       0      0 :::111                  :::*                    LISTEN      528/rpcbind

As you can see in my case rspamd is only listening on IPv4 (shown with tcp in first column). I personally disabled IPv6 for exim, by inserting:
disable_ipv6=true
in my /etc/exim_variables.conf
that tells exim to not use IPv6. That should prevent it from ever attempting to connect to your rspamd via IPv6.

Leap · Feb 1, 2021

Code:

# netstat -anp |grep LISTEN
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      953/dovecot
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      953/dovecot
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      947/exim
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      953/dovecot
tcp        0      0 127.0.0.1:783           0.0.0.0:*               LISTEN      1151/perl
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      953/dovecot
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      947/exim
tcp        0      0 31.200.209.174:53       0.0.0.0:*               LISTEN      2475/named
tcp        0      0 31.200.209.173:53       0.0.0.0:*               LISTEN      2475/named
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2475/named
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      952/pure-ftpd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      951/sshd
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      2475/named
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      947/exim
tcp6       0      0 :::443                  :::*                    LISTEN      1236/httpd
tcp6       0      0 :::993                  :::*                    LISTEN      953/dovecot
tcp6       0      0 :::995                  :::*                    LISTEN      953/dovecot
tcp6       0      0 :::3306                 :::*                    LISTEN      1101/mysqld
tcp6       0      0 :::587                  :::*                    LISTEN      947/exim
tcp6       0      0 :::4206                 :::*                    LISTEN      2807/node
tcp6       0      0 :::110                  :::*                    LISTEN      953/dovecot
tcp6       0      0 :::2222                 :::*                    LISTEN      965/directadmin
tcp6       0      0 :::143                  :::*                    LISTEN      953/dovecot
tcp6       0      0 :::80                   :::*                    LISTEN      1236/httpd
tcp6       0      0 :::465                  :::*                    LISTEN      947/exim
tcp6       0      0 :::21                   :::*                    LISTEN      952/pure-ftpd
tcp6       0      0 :::22                   :::*                    LISTEN      951/sshd
tcp6       0      0 :::3000                 :::*                    LISTEN      2928/node
tcp6       0      0 ::1:953                 :::*                    LISTEN      2475/named
tcp6       0      0 :::25                   :::*                    LISTEN      947/exim

I do want Exim to use IPv6...

toml · Feb 1, 2021

If you want exim to support IPv6 then you need to figure out how to enable rspamd to listen to IPv6, I am not 100% sure since I didn't need to yet. Try googling how to do that.

factor · Feb 1, 2021

https://help.directadmin.com/item.php?id=353

Code:

/usr/sbin/exim -bV | grep Support

do you see IPV6 in here?

/usr/sbin/exim -bV
Support for: crypteq IPv6 Perl OpenSSL move_frozen_messages Content_Scanning DKIM DNSSEC Event OCSP PIPE_CONNECT PRDR SPF TCP_Fast_Open Experimental_SRS

Exim keeps sending the same mail

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User