Issue qmail problem: Error during 'spam' handler - Error during 'dd52-domainkeys' handler

[Rendor9]

Hi! I have the following problem, I am receiving failure notices, 1 per minute and a client reports that his email account is not working. The others email accounts work fine, it's just one particular email (myemail@mysite.com.ar). When entering webmail, the last emails are not seen. Its an attack? Any idea? Thanks

When viewing the status of qmail, I get:

qmail.service - Panel qmail MTA service
Loaded: loaded (/lib/systemd/system/qmail.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2022-01-28 18:13:30 -03; 1h 16min ago
Main PID: 27937 (qmail-send)
CGroup: /system.slice/qmail.service
├─ 3024 /var/qmail/bin/qmail-local.moved -- popuser /var/qmail/mailnames/mysite.com.ar/account mysite.com.ar-account mysite.com.ar follow@mysite.com.ar | /usr/bin
├─ 3030 /bin/sh -c /usr/lib/dovecot/dovecot-lda -d "$DELIVERED_TO"
├─ 3031 /usr/lib/dovecot/dovecot-lda -d myemail@mysite.com.ar
├─27937 qmail-send
├─27939 splogger qmail
├─27940 qmail-lspawn | /usr/bin/deliverquota ./Maildir
├─27941 qmail-rspawn
└─27942 qmail-clean

Jan 28 19:29:39 myhosting.com qmail-local-handlers[3055]: mailbox: /var/qmail/mailnames/myhosting.com/xxxx
Jan 28 19:29:39 myhosting.com qmail-local-handlers[3055]: Error during 'spam' handler
Jan 28 19:29:39 myhosting.com qmail-local-handlers[3055]: Error during 'dd52-domainkeys' handler
Jan 28 19:29:39 myhosting.com qmail-local-handlers[3055]: Error during 'dmarc' handler
Jan 28 19:29:39 myhosting.com qmail[27939]: 1643408979.270340 delivery 330: success: lda(xxxx@myhosting.com):_Error:_net_connect_unix(/var/run/dovecot/stats-writer)_failed:_Permissi
Jan 28 19:29:39 myhosting.com qmail[27939]: 1643408979.270358 status: local 2/10 remote 0/20
Jan 28 19:29:39 myhosting.com qmail[27939]: 1643408979.270378 end msg 4856568
Jan 28 19:29:56 myhosting.com dovecot[2979]: service=lda, user=myemail@mysite.com.ar, ip=[]. Error: sieve: msgid=<f9b008e304609cd973232ccfff73d9ca@mysite.com.ar>: redirect action: fa
Jan 28 19:29:56 myhosting.com qmail[27939]: 1643408996.185255 delivery 323: deferral: lda(myemail@mysite.com.ar):_Error:_net_connect_unix(/var/run/dovecot/stats-writer)_failed:_Perm
Jan 28 19:29:56 myhosting.com qmail[27939]: 1643408996.185267 status: local 1/10 remote 0/20

 

[tkalfaoglu]

Probably not related but the stat writer's perms/owner should be:

# ls -l /var/run/dovecot/stats-writer
srw-rw---- 1 popuser dovecot 0 Jan 29 06:00 /var/run/dovecot/stats-writer