some mails get delayed 5min, some don't

lists at sbt.net.au lists at sbt.net.au
Wed Oct 11 13:21:52 CEST 2023 

I've had this issue for a while, some emails get processed OK, and some
get around 5 min delay, I've tried to check setup against some guides I;ve
used, but without success. just as I've re-enabled it I've noticed two
almost identical spam emails to two different users on server, one gets
through no delay, one gets 300??? ms delay but I'm still at a loss:

what else to look at/check?
increase amavis $log_level = 0; ?

main.cf

content_filter = smtp-amavis:[127.0.0.1]:10024
smtp-amavis_destination_recipient_limit = 1
smtp-amavis_destination_concurrency_limit = 2
smtpd_proxy_options = speed_adjust

master.cf

smtp-amavis unix -      -       n       -       2  smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20

127.0.0.1:10025 inet n  -       n       -       -  smtpd
    -o content_filter=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o smtpd_restriction_classes=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_tls_security_level=none
    -o mynetworks_style=host
    -o strict_rfc821_envelopes=yes
    -o
receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_address_mappings,no_milters
    -o local_header_rewrite_clients=


I've grepped the maillog by message ID as follows:

delayed spam

grep 5CD3F203CC8  /var/log/maillog

Oct  9 08:33:30 geko postfix/smtpd[2187]: 5CD3F203CC8:
client=blueoven.sa.com[185.86.6.204]
Oct  9 08:33:30 geko postfix/cleanup[2156]: 5CD3F203CC8:
message-id=<KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>
Oct  9 08:33:30 geko opendkim[923]: 5CD3F203CC8: key retrieval failed
(s=keys, d=blueoven.sa.com): 'keys._domainkey.blueoven.sa.com' record not
found
Oct  9 08:33:30 geko opendmarc[895]: 5CD3F203CC8 ignoring
Authentication-Results at 1 from geko.sbt.net.au
Oct  9 08:33:31 geko opendmarc[895]: 5CD3F203CC8: SPF(mailfrom):
blueoven.sa.com pass
Oct  9 08:33:31 geko opendmarc[895]: 5CD3F203CC8: blueoven.sa.com pass
Oct  9 08:33:31 geko postfix/qmgr[29319]: 5CD3F203CC8:
from=<externally at blueoven.sa.com>, size=11832, nrcpt=1 (queue active)
Oct  9 08:38:31 geko amavis[25835]: (25835-11) Passed CLEAN
{RelayedInbound}, [185.86.6.204]:2135 [185.86.6.204]
<externally at blueoven.sa.com> -> <ddd at tld.com.au>, Queue-ID: 5CD3F203CC8,
Message-ID:
<KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>,
mail_id: Xcxoab4xOiX1, Hits: -0.649, size: 12276, queued_as: 65D2F203CD5,
300377 ms
Oct  9 08:38:31 geko postfix/smtp[32346]: 5CD3F203CC8:
to=<ddd at tld.com.au>, relay=127.0.0.1[127.0.0.1]:10024, delay=302,
delays=1.3/0/0.01/300, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 65D2F203CD5)
Oct  9 08:38:31 geko postfix/qmgr[29319]: 5CD3F203CC8: removed

# grep 65D2F203CD5 /var/log/maillog

Oct  9 08:38:31 geko postfix/smtpd[4339]: 65D2F203CD5:
client=localhost[127.0.0.1]
Oct  9 08:38:31 geko postfix/cleanup[4380]: 65D2F203CD5:
message-id=<KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>
Oct  9 08:38:31 geko postfix/qmgr[29319]: 65D2F203CD5:
from=<externally at blueoven.sa.com>, size=12774, nrcpt=1 (queue active)
Oct  9 08:38:31 geko amavis[25835]: (25835-11) Passed CLEAN
{RelayedInbound}, [185.86.6.204]:2135 [185.86.6.204]
<externally at blueoven.sa.com> -> <ddd at tld.com.au>, Queue-ID: 5CD3F203CC8,
Message-ID:
<KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>,
mail_id: Xcxoab4xOiX1, Hits: -0.649, size: 12276, queued_as: 65D2F203CD5,
300377 ms
Oct  9 08:38:31 geko postfix/smtp[32346]: 5CD3F203CC8:
to=<ddd at tld.com.au>, relay=127.0.0.1[127.0.0.1]:10024, delay=302,
delays=1.3/0/0.01/300, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 65D2F203CD5)
Oct  9 08:38:31 geko postfix/pipe[4383]: 65D2F203CD5: to=<ddd at tld.com.au>,
relay=dovecot, delay=0.07, delays=0.01/0.01/0/0.05, dsn=2.0.0, status=sent
(delivered via dovecot service)
Oct  9 08:38:31 geko postfix/qmgr[29319]: 65D2F203CD5: removed


not delayed


# grep B61CA203CD5  /var/log/maillog

Oct  9 08:38:16 geko postfix/smtpd[4376]: B61CA203CD5:
client=blueoven.sa.com[185.86.6.204]
Oct  9 08:38:19 geko postfix/cleanup[4380]: B61CA203CD5:
message-id=<XS2hHGcRUd3Hb5zd_b4lwBM9_aCRR476Pwiwn50nDlI.n4FQ06TGT2KChxrIxV-WCwu6DHcQHVTKCJFR7tFuaQ0 at blueoven.sa.com>
Oct  9 08:38:19 geko opendkim[923]: B61CA203CD5: key retrieval failed
(s=keys, d=blueoven.sa.com): 'keys._domainkey.blueoven.sa.com' record not
found
Oct  9 08:38:19 geko opendmarc[895]: B61CA203CD5 ignoring
Authentication-Results at 1 from geko.sbt.net.au
Oct  9 08:38:19 geko opendmarc[895]: B61CA203CD5: SPF(mailfrom):
blueoven.sa.com pass
Oct  9 08:38:19 geko opendmarc[895]: B61CA203CD5: blueoven.sa.com pass
Oct  9 08:38:19 geko postfix/qmgr[29319]: B61CA203CD5:
from=<arthritic at blueoven.sa.com>, size=11713, nrcpt=1 (queue active)
Oct  9 08:38:22 geko amavis[12642]: (12642-16) Passed CLEAN
{RelayedInbound}, [185.86.6.204]:56398 [185.86.6.204]
<arthritic at blueoven.sa.com> -> <vvv at tld2.com.au>, Queue-ID: B61CA203CD5,
Message-ID:
<XS2hHGcRUd3Hb5zd_b4lwBM9_aCRR476Pwiwn50nDlI.n4FQ06TGT2KChxrIxV-WCwu6DHcQHVTKCJFR7tFuaQ0 at blueoven.sa.com>,
mail_id: 6hY-iVrHKacG, Hits: 0.027, size: 12159, queued_as: 3F2B9203CD0,
2776 ms
Oct  9 08:38:22 geko postfix/smtp[4381]: B61CA203CD5:
to=<vvv at tld2.com.au>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.1,
delays=3.2/0.05/0.01/2.8, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3F2B9203CD0)
Oct  9 08:38:22 geko postfix/qmgr[29319]: B61CA203CD5: removed

# grep 3F2B9203CD0  /var/log/maillog

Oct  9 08:38:22 geko postfix/smtpd[4339]: 3F2B9203CD0:
client=localhost[127.0.0.1]
Oct  9 08:38:22 geko postfix/cleanup[4380]: 3F2B9203CD0:
message-id=<XS2hHGcRUd3Hb5zd_b4lwBM9_aCRR476Pwiwn50nDlI.n4FQ06TGT2KChxrIxV-WCwu6DHcQHVTKCJFR7tFuaQ0 at blueoven.sa.com>
Oct  9 08:38:22 geko postfix/qmgr[29319]: 3F2B9203CD0:
from=<arthritic at blueoven.sa.com>, size=12626, nrcpt=1 (queue active)
Oct  9 08:38:22 geko amavis[12642]: (12642-16) Passed CLEAN
{RelayedInbound}, [185.86.6.204]:56398 [185.86.6.204]
<arthritic at blueoven.sa.com> -> <vvv at tld2.com.au>, Queue-ID: B61CA203CD5,
Message-ID:
<XS2hHGcRUd3Hb5zd_b4lwBM9_aCRR476Pwiwn50nDlI.n4FQ06TGT2KChxrIxV-WCwu6DHcQHVTKCJFR7tFuaQ0 at blueoven.sa.com>,
mail_id: 6hY-iVrHKacG, Hits: 0.027, size: 12159, queued_as: 3F2B9203CD0,
2776 ms
Oct  9 08:38:22 geko postfix/smtp[4381]: B61CA203CD5:
to=<vvv at tld2.com.au>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.1,
delays=3.2/0.05/0.01/2.8, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3F2B9203CD0)
Oct  9 08:38:22 geko postfix/pipe[4383]: 3F2B9203CD0:
to=<vvv at tld2.com.au>, relay=dovecot, delay=0.2, delays=0.03/0.03/0/0.15,
dsn=2.0.0, status=sent (delivered via dovecot service)
Oct  9 08:38:22 geko postfix/qmgr[29319]: 3F2B9203CD0: removed


spam 1 header

Return-Path: <externally at blueoven.sa.com>
Delivered-To: ddd at tld.com.au
Received: from localhost (localhost [127.0.0.1])
        by geko.sbt.net.au (Postfix) with ESMTP id 65D2F203CD5
        for <ddd at tld.com.au>; Mon,  9 Oct 2023 08:38:31 +1100 (AEDT)
X-Virus-Scanned: amavisd-new at sbt.net.au
Received: from geko.sbt.net.au ([127.0.0.1])
        by localhost (geko.sbt.net.au [127.0.0.1]) (amavisd-new, port 10024)
        with ESMTP id Xcxoab4xOiX1 for <ddd at tld.com.au>;
        Mon,  9 Oct 2023 08:33:31 +1100 (AEDT)
Received: from blueoven.sa.com (blueoven.sa.com [185.86.6.204])
        by geko.sbt.net.au (Postfix) with ESMTP id 5CD3F203CC8
        for <ddd at tld.com.au>; Mon,  9 Oct 2023 08:33:29 +1100 (AEDT)
DMARC-Filter: OpenDMARC Filter v1.4.1 geko.sbt.net.au 5CD3F203CC8
Authentication-Results: OpenDMARC; dmarc=pass (p=quarantine dis=none)
header.from=blueoven.sa.com
Authentication-Results: OpenDMARC; spf=pass smtp.mailfrom=blueoven.sa.com
DKIM-Filter: OpenDKIM Filter v2.11.0 geko.sbt.net.au 5CD3F203CC8
Authentication-Results: geko.sbt.net.au;
        dkim=fail reason="key not found in DNS" (0-bit key)
header.d=blueoven.sa.com header.i=externally at blueoven.sa.com
header.b="ClISCQts"
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=keys;
d=blueoven.sa.com;
 h=Date:From:MIME-Version:To:Subject:Message-ID:Content-Type:Content-Transfer-Encoding;
i=externally at blueoven.sa.com;
 bh=MzFU8HdlSSx2tjJuw2MY6lUStWo=;
 b=ClISCQts2FsbFeGWZHfLpZJp+9bfd3RIx0fYZw+22P1j567uQDOtJq+gHPM7FJPJo7tS45597u1r

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=keys; d=blueoven.sa.com;
 b=Ib1HDA/vRO8257fl8K8Nw8h8b/99GpfM6oadhuLCJi/v5QNTqonDPSH/ck0xAJ2ncy8fAZwKcUm6

Date: Sun, 08 Oct 2023 16:28:55 -0500
From: "Get Relief Now" <externally at blueoven.sa.com>
MIME-Version: 1.0
Precedence: bulk
To: <ddd at tld.com.au>
Subject: Goodbye to Painful Aches - Get Relief Now

More information about the amavis-users mailing list