outgoing mail control not working

[John_Wilkins]

I've searched, since about update 37 the outgoing mail control has stopped working for all of my domains. I get a hacker sendmail script uploaded sometimes and it used to catch it. Now it allows them to send and isn't detected them, maxing out my relays.

 

[IgorG]

Any details, logs, error messages, results of troubleshooting, etc?

 

[John_Wilkins]

I checked the ail log not sure where the outgoing mail control error logs would be.

 

[si458]

Hi All,
I have the exact same issue, however mine was because a user was password cycled!
I through the outbound mail limit would of locked the user or at least send the admin an email, but nothing?
and what's also weird is the user outbound info panel shows that it sent NO emails that whole day?
any suggestions?
Simon

 

[John_Wilkins]

It happened again. Caught it before my 5000 emails per day was reached. The outgoing mail control is no longer working. I have the log of user running script, what log do you need to show outgoing mail control isn't working?

 

[John_Wilkins]

The outgoing mail control logs control panel all show zero for sent mail on the problem domain (the rest show)

 

[si458]

sadly our servers where blacklisted before we noticed the SPAM,
can you change the title of this topic? then its easier to identify
something like - outgoing mail control not working

 

[IgorG]

sadly our servers where blacklisted before we noticed the SPAM,
can you change the title of this topic? then its easier to identify

What is your new title?

 

[si458]

something like - outgoing mail control not working

 

[IgorG]

something like - outgoing mail control not working

Done.

 

[John_Wilkins]

What log can I post to help show its not working?

 

[madadam]

Any update on this - I have the same issue?

How are the messages counted? I have an issue (Plesk 12.5 on Linux / CentOS 6 with Postfix) where some outgoing mail (which happened to be from a spammer!) was not counted. The domain showed 0 outgoing mails in stats, but the maillog has the following (small extract):

Feb 7 02:02:34 advic postfix/smtpd[9318]: 546FA22C10: client=unknown[89.22.130.102], sasl_method=PLAIN, sasl_username=<user>@<domain>.com
Feb 7 02:02:34 advic postfix/cleanup[3516]: 0633F22A43: message-id=<83878B616CB01B857114FDF470B12BAE@mail.<domain>.com>
Feb 7 02:02:34 advic postfix/qmgr[14757]: 0633F22A43: from=<juppschmitz1987@<domain>.com>, size=5748, nrcpt=20 (queue active)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603b0u00146fd0k@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603b4tt00qsei8h@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603b8vn0082nm22@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603bcve00kgd1ad@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603bh2p01696ldi@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603bkdj0022r31t@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603bnm300t0um03@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp04qh2603brok01qb2giq@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp088pgj03b91100d0j8s8@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp088pgj03bnm101h19dp7@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03b0rj00llk4r0@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03b4uk011g0490@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03bcu900r8mlsb@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03bh0m01smn0lg@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03bkb501s9oido@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03brkn00uc6557@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp0a94fh03bvit016t6318@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp14273303b2nc01pou44t@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp14273303bas601s2t6j3@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/smtp[3552]: 0633F22A43: to=<info-emid0aa02tv0ilp14273303bt4r00nda3hf@news.groupon.de>, relay=mail.fagms.net[62.27.38.63]:25, delay=9, delays=9/0.01/0.03/0.01, dsn=2.6.0, status=sent (250 2.6.0 message received)
Feb 7 02:02:34 advic postfix/qmgr[14757]: 0633F22A43: removed
Feb 7 02:02:35 advic postfix/cleanup[2775]: 546FA22C10: message-id=<DCFEE386A2553F5FE740FFAD2EE6A8D9@mail.<domain>.com>

This is repeated for 1000's of messages yet not one appears in the outgoing stats!

Meanwhile, for other domains I do see outgoing messages tracked normally.

Why are the above messages on a particular domain not counted correctly?

I'm wondering if it has anything to do with the fact that the user was SASL authenticated?

Are there any logs for Outgoing Mail Control to track what it is doing?