Disappearing Incoming Mail

[cearnshaw]

Hi,

I've occasionally seen some problems with incoming mail disappearing, i.e. the transaction shows up in the smtp log as completed but the message never reaches the customer's account and doesn't show up in the account log.

In my current instance I don't see it hitting any content filter rules, but just in case I put a "bypass" rule in as the first rule based on the recipient's e-mail address. I have also white listed the sender's I.P. address in the spam filter (and this is confirmed by the entry in the SMTP log when the message is received) and the transaction appears to complete successfully... just that the message never reaches the user's account.

In comparing the logs of messages that come through successfully vs. those that don't, I don't see any differences (these are regular mails received from a forum mail list), except that I notice that the messages that disappear seem to come through when the sever is busy, i.e. lots of simultaneous transactions taking place smtp in the logs. Could it be that my server cannot keep up? We have about 2,000 accounts on this server now. It's using an Intel Celeron processor running at 3.46 GHz with 2 GB of RAM. CPU utilisation seems to be running at less than 10% most of the time but I do see occasional spikes up to 100%.

I am using Trend-Micro Anti Virus and it does not incorporate any spam detection.

Thanks,


Cameron

[rob]

Disappearing mails can be caused by several things but presently we have no reports of busy email servers losing mails (the system should always ensure an error message is logged when any mail cannot be delivered for some reason). The first and foremost cause is simply SPAM filtering (which can occur at any stage in the SMTP transfer). Of course content filtering can also cause mails to vanish depending on your setup. Another cause can be the mails simply never complete the transaction (i.e. the sender gives up or AMS refuses the mail at the last stage due to SPAM/time out). Of course in a busy log, it can be hard to spot these failure notices as many events can intercede the initial connection. One thing I would recommend is examine all the logs for trace of the mail (incluidng outmail logs), as sometimes options such as redirections, POP3 Retrievals, backup domains can complicate finding where the mail went. If you would like me to examine any logs, feel free to send them to rob@code-crafters.com.