Lot of duplicate emails

sevenymedia

Verified User
Joined
Sep 28, 2015
Messages
34
I experienced an issue with Exim overnight. I got some clients telling me they weren't able to send any emails, I gave it a try through two of my own accounts and indeed I also got the warning that the outgoing mailserver wasn't responding.

I ssh-ed into the server and did see Exim active and also traffic going through, but just to be sure I did a service restart, which took quite a while (like at least one minute..) and after that some emails were coming in, even from yesterday. And the emails I sent for testing were also send.. but twice. Now after going through some mailboxes I'm seeing lots of duplicate emails, which started around yesterday afternoon.

Below some log results of two different emails which I received like 10 times.

I hope somebody is able to point me in the right direction to find the cause of the issue, probably worth mentioning is that this is the second time this happened, exactly the same thing happened like three weeks ago.

Code:
2020-07-19 13:56:26 1jx7ve-0003NW-BI <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 14:21:26 1jx8Jq-0005LG-OT <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 14:46:27 1jx8i2-0007FD-Lb <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 15:26:27 1jx9Kl-00023l-L7 <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 16:36:28 1jxAQV-000777-VR <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 17:46:28 1jxBWG-0006rG-C7 <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 18:56:28 1jxCc0-0006Ok-F7 <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 20:06:29 1jxDhk-0007Pk-M8 <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 21:16:29 1jxEnU-0001lw-UC <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 22:26:31 1jxFtG-0004a1-GY <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-19 23:36:31 1jxGz1-0004jw-9x <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 00:46:32 1jxI4m-0005YP-7e <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 01:56:33 1jxJAX-0003El-1D <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 03:06:33 1jxKGH-0006Gt-Mx <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 04:16:35 1jxLM2-0006gF-Bx <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 05:26:35 1jxMRm-00054s-U6 <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***
2020-07-20 06:36:35 1jxNXX-00061V-FL <= [email protected] H=smtp-relay-03.hcbmedia.nl [194.48.214.27] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=19627 DKIM=qassa.nl id=1595159785.9f96f36b7aae3b1ff847c26ac94c604e@cron2.prod.qassa.cyso.net T="***" from <[email protected]> for ***

Code:
2020-07-20 01:24:53 1jxIfs-0005hs-N5 <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 01:35:25 1jxIq4-0004df-6L <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 01:46:30 1jxJ0n-0004lX-KP <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 01:58:04 1jxJC0-0004fC-94 <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 02:10:10 1jxJNi-0005i9-05 <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 02:24:14 1jxJbK-0006M0-8x <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 02:42:39 1jxJt9-0005JD-H7 <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 03:07:45 1jxKHQ-0002LE-Q7 <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 03:47:50 1jxKuD-0005Rj-ER <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 04:57:55 1jxM03-0001zP-CH <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
2020-07-20 08:08:00 1jxOxz-0004ZO-Tf <= ***@mail.haveibeenpwned.com H=o1.mail.haveibeenpwned.com [167.89.85.8] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=12048 DKIM=haveibeenpwned.com [email protected] T="You're one of 268,765,495 people pwned in the Wattpad data breach" from <***@mail.haveibeenpwned.com> for ***
 
Stucked mail? , problems with restarting exim ?, sound to me that you have exim 4.94, try to downgrade to 4.93.0.4
Several threads on this forum can help you herein
 
Stucked mail? , problems with restarting exim ?, sound to me that you have exim 4.94, try to downgrade to 4.93.0.4
Several threads on this forum can help you herein

Thank you, I just did the downgrade, I'll keep an eye on it
 
So according to file timestamps (and exim --version) I downgraded 10:46 AM today, but after that I already got two notifications about the same reply on this topic.

Code:
$ exim --version
Exim version 4.93.0.4 #5 built 20-Jul-2020 10:46:12
Copyright (c) University of Cambridge, 1995 - 2018
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2018
Berkeley DB: Berkeley DB 5.3.21: (May 11, 2012)
Support for: crypteq IPv6 Perl OpenSSL move_frozen_messages Content_Scanning DKIM DNSSEC Event OCSP PRDR SPF TCP_Fast_Open Experimental_SRS
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb
Authenticators: cram_md5 dovecot plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: f-protd f-prot6d drweb aveserver fsecure kavdaemon sophie clamd mksd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
2020-07-20 13:36:36 cwd=/var/log/exim 2 args: exim --version
Configuration file is /etc/exim.conf

Code:
2020-07-20 09:50:41 1jxQZL-0006np-1x <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10065 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 09:56:20 1jxQep-0003Dx-Cl <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10065 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 10:57:01 1jxRbZ-0000ix-1K <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10069 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 12:58:13 1jxTUq-0007cg-Nn <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10132 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
 
Hmm , after the downgrade of exim , did you also rebuild exim_conf ?
 
Hmm , after the downgrade of exim , did you also rebuild exim_conf ?

Yes I did, but just found out that my /etc/exim.dkim.conf wasn't compatible anymore because of lsearch,ret=key, so I fixed that and restarted Exim again..

Let's see if that was the final trick to fix the malfunctioning.
 
Ok.. great.. it seems it wasn't

Code:
2020-07-20 14:24:55 1jxUqk-0005mc-Uj <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9885 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 14:30:28 1jxUw7-0000Kq-HS <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9871 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
 
How did you modify exim.dkim.conf?

Probably not same problem because after some time I have a problem with duplicate emails which are send from server outside. After restart exim everything is ok for some time.

I know that my server is under attack and I saw lot of
" login authenticator failed for (User) [185.143.73.33]: 535 Incorrect authentication data "
but I block this in CSF through regex.pm (some solution I found recently on Directadmin forum).

Could you help me also?
 
How did you modify exim.dkim.conf?

Here's the diff:
Code:
> #  dkim_domain = ${if eq{${lc:${domain:$h_from:}}}{}{$primary_hostname}{${lookup{${lc:${domain:$h_from:}}}lsearch,ret=key{/etc/virtual/domainowners}{$value}}}}
< #  dkim_domain = ${if eq{${lc:${domain:$h_from:}}}{}{$primary_hostname}{${lookup{${lc:${domain:$h_from:}}}lsearch,ret=key{/etc/virtual/domainowners}{$value}}}}
<   dkim_domain = $sender_address_domain
 
That is really odd, but I assume you get rid of stucked mails right ?
 
TYI

Here are log lines for all notifications for this thread... there should actually be only three 😕

Code:
2020-07-20 09:50:41 1jxQZL-0006np-1x <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10065 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 09:56:20 1jxQep-0003Dx-Cl <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10065 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 10:57:01 1jxRbZ-0000ix-1K <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10069 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 12:58:13 1jxTUq-0007cg-Nn <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10132 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 14:24:55 1jxUqk-0005mc-Uj <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9885 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 14:30:28 1jxUw7-0000Kq-HS <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9871 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 15:14:24 1jxVcd-0002eL-9d <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10755 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 15:19:58 1jxVi2-00056w-1P <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=10755 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 15:22:13 1jxVkD-0005hH-HD <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9873 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 15:27:50 1jxVpd-0007eA-NV <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9873 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
 
Could you explain this a little?
Sure, you had 2 problems
1. stucked mail in que ( you got the warning that the outgoing mailserver wasn't responding. )
2. double emails
Problem is solved, but 2 seems unsloved right ?

regarding double mails, we had the same problem on one of our nodes ,
Downgrading EXIM did the trick , sorry it didnt work for you
 
Sure, you had 2 problems
1. stucked mail in que ( you got the warning that the outgoing mailserver wasn't responding. )
2. double emails
Problem is solved, but 2 seems unsloved right ?

Yeah that's right, but the stuck mail was already solved after I restarted Exim early this morning, so before downgrading to 4.93
 
Some more detailed info from exim about one of the dups

Code:
$ exigrep '[email protected]' ./mainlog 
2020-07-20 14:24:55 1jxUqk-0005mc-Uj <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9885 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 14:24:55 1jxUqk-0005mc-Uj => *** <***> F=<[email protected]> R=virtual_user T=dovecot_lmtp_udp S=10256 C="250 2.0.0 <***> 9NHXMxeNFV8mNAAAOrLE3g Saved"
2020-07-20 14:24:55 1jxUqk-0005mc-Uj Completed

2020-07-20 14:30:28 1jxUw7-0000Kq-HS <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9871 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 14:30:28 1jxUw7-0000Kq-HS => *** <***> F=<[email protected]> R=virtual_user T=dovecot_lmtp_udp S=10241 C="250 2.0.0 <***> GaMiF2SOFV/yVgAAOrLE3g Saved"
2020-07-20 14:30:28 1jxUw7-0000Kq-HS Completed

2020-07-20 15:31:35 1jxVtH-0000lb-CS <= [email protected] H=forum.directadmin.com [69.162.69.58] P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=9871 DKIM=forum.directadmin.com [email protected] T="Lot of duplicate emails - New reply to watched thread" from <[email protected]> for ***
2020-07-20 15:31:35 1jxVtH-0000lb-CS => *** <***> F=<[email protected]> R=virtual_user T=dovecot_lmtp_udp S=10241 C="250 2.0.0 <***> 2OljKrecFV9WcwAAOrLE3g Saved"
2020-07-20 15:31:35 1jxVtH-0000lb-CS Completed
 
Yeah that's right, but the stuck mail was already solved after I restarted Exim early this morning, so before downgrading to 4.93
We had that problem too, yes restarting solved the problem but after few days it came back so restarting Exim was an temp. solution for us
reverting Exim to 4.93.04 was also the solution
 
Somehow it looks like the duplicate email issue now only keeps happening on notifications on this thread. I'm still receiving notifications about replies made yesterday.

Might this have something to do with retries from the remote server? Something that the receiving party doesn't respond with the correct SMTP code somehow?
 
After revert to 4.93.0.4 and modify exim.dkim.conf to not use lsearch,ret=key I don't see any duplicate e-mails. Before one e-mail could have about 10-50 copies. Clients like Outlook try to resend email, so it made a many copies of emails.
Why nobody from support Directadmin respond for this?
 
@remikk Glad that your problem is solved.
I am afraid this is an Exim issue rather than DA so I don't expect that staff will interfere here.
 
Back
Top