Submitted by websmurf on Tue, 05/19/2020 - 07:20
Not entirely sure where this is coming from exactly, but since we've enabled the mail rate limiting option in Virtualmin we are running into an issue with email from (mostly) outlook.com.
This is the logging I see in the mail.log file:
May 19 13:51:09 web1 postfix/policy-spf[10577]: Policy action=PREPEND Received-SPF: pass (nvesalaris.nl: Sender is authorized to use 'sender@client.nl' in 'mfrom' identity (mechanism 'include:spf.client.nl' matched)) receiver=web1; identity=mailfrom; envelope-from="sender@client.nl"; helo=EUR03-VE1-obe.outbound.protection.outlook.com; client-ip=40.107.5.44
May 19 13:51:09 web1 postfwd2/policy[12983]: [DNSBL] 40.107.5.44 listed on rbl:list.dnswl.org (answer: 127.0.3.0, time: 0.01s, ttl: 10800s, 'outlook.com https://dnswl.org/s/?s=1357')
May 19 13:51:09 web1 postfwd2/policy[12983]: [RULES] rule=7, id=RWL_003, client=mail-eopbgr50044.outbound.protection.outlook.com[40.107.5.44], sender=<sender@client.nl>, recipient=<email@address.nl>, helo=<EUR03-VE1-obe.outbound.protection.outlook.com>, proto=ESMTP, state=RCPT, delay=0.29s, hits=RWL_001;RWL_003, action=PREPEND X-PFW-STATE: INFO: [rbl:list.dnswl.org:<outlook.com https://dnswl.org/s/?s=1357>]
May 19 13:51:09 web1 milter-greylist: (unknown id): skipping greylist because this is the default action, (from=<sender@client.nl>, rcpt=<email@address.nl>, addr=mail-eopbgr50044.outbound.protection.outlook.com[40.107.5.44]) ACL 78
May 19 13:51:09 web1 postfix/smtpd[9907]: 632A920975: client=mail-eopbgr50044.outbound.protection.outlook.com[40.107.5.44]
May 19 13:51:09 web1 postfix/cleanup[6800]: 632A920975: message-id=<AM5P189MB0562A943D8EC539E3F232728B8B90@AM5P189MB0562.EURP189.PROD.OUTLOOK.COM>
May 19 13:51:09 web1 milter-greylist: DKIM failed: Key retrieval failed
May 19 13:51:09 web1 postfix/cleanup[6800]: 632A920975: milter-reject: END-OF-MESSAGE from mail-eopbgr50044.outbound.protection.outlook.com[40.107.5.44]: 4.7.1 Service unavailable - try again later; from=<sender@client.nl> to=<email@address.nl> proto=ESMTP helo=<EUR03-VE1-obe.outbound.protection.outlook.com>
I have replaced the sender and receiver with redacted mail addresses. As you can see, it passes through policy-spf first (without any issues), then moves to milter-greylist and there it fails in the cleanup step with the following error: DKIM failed: Key retrieval failed
We haven't enabled DKIM signing on our server. I've been looking for some time now, but haven't gotten a clue about how to debug this problem. This is happening quite a bit, around 50 - 100 times a day. Often Microsoft will retry the email after some time and the 3rd or 4th time the email will pass through, but this results in quite some delay before the email is delivered.
Do you have any idea what this could be?
Postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
home_mailbox = Maildir/
inet_interfaces = all
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
message_size_limit = 50000000
milter_default_action = accept
milter_protocol = 2
mydestination = web1, localhost
myhostname = web1
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = local:/var/run/milter-greylist/milter-greylist.sock
policy-spf_time_limit = 3600s
readme_directory = no
recipient_delimiter = +
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_milters = local:/var/run/milter-greylist/milter-greylist.sock
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination check_policy_service unix:private/policy-spf check_policy_service inet:127.0.0.1:10040
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_tls_CAfile = /etc/webmin/letsencrypt-ca.pem
smtpd_tls_cert_file = /etc/webmin/letsencrypt-cert.pem
smtpd_tls_key_file = /etc/webmin/letsencrypt-key.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_maps = hash:/etc/postfix/virtual
greylist.conf
#
# Simple greylisting config file using the new features
# See greylist2.conf for a more detailed list of available options
#
# $Id: greylist.conf,v 1.50 2013/08/13 12:45:08 manu Exp $
#
pidfile "/var/run/milter-greylist.pid"
dumpfile "/var/lib/milter-greylist/greylist.db" 600
dumpfreq 10m
geoipdb "/usr/share/GeoIP/GeoIP.dat"
socket "/var/spool/postfix/var/run/milter-greylist/milter-greylist.sock" 666
user "smmsp"
# Do not tell spammer how long they have to wait
quiet
# And here is the access list
ratelimit "virtualmin_limit" rcpt 30 / 30m key "%f"
racl greylist from /.*/ ratelimit "virtualmin_limit" delay 31m autowhite 0m msg "Message quota exceeded"
racl whitelist default
# Example of content filtering for fighting image SPAM
#dacl blacklist body /src[:blank:]*=(3D)?[:blank:]*["']?[:blank:]*cid:/ \
# msg "Sorry, We do not accept images embedded in HTML"
nospf
noauthStatus:
Active
Comments
Submitted by websmurf on Tue, 05/19/2020 - 07:21 Comment #1
Submitted by websmurf on Tue, 05/19/2020 - 07:38 Comment #2
Submitted by websmurf on Tue, 05/19/2020 - 08:03 Comment #3
Submitted by websmurf on Tue, 05/19/2020 - 08:24 Comment #4
Could this be something DNS related?