some mails get delayed 5min, some don't

[Matus UHLAR - fantomas]

On 11.10.23 22:21, lists at sbt.net.au wrote:
>I've had this issue for a while, some emails get processed OK, and some
>get around 5 min delay, I've tried to check setup against some guides I;ve
>used, but without success. just as I've re-enabled it I've noticed two
>almost identical spam emails to two different users on server, one gets
>through no delay, one gets 300??? ms delay but I'm still at a loss:
>
>what else to look at/check?
>increase amavis $log_level = 0; ?

I use:

$log_level                      = 1;
$log_templ                      = $log_verbose_templ;

>I've grepped the maillog by message ID as follows:
>
>delayed spam
>
>grep 5CD3F203CC8  /var/log/maillog
>
>Oct  9 08:33:30 geko postfix/smtpd[2187]: 5CD3F203CC8:
>client=blueoven.sa.com[185.86.6.204]
>Oct  9 08:33:30 geko postfix/cleanup[2156]: 5CD3F203CC8:
>message-id=<KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>
>Oct  9 08:33:30 geko opendkim[923]: 5CD3F203CC8: key retrieval failed
>(s=keys, d=blueoven.sa.com): 'keys._domainkey.blueoven.sa.com' record not
>found
>Oct  9 08:33:30 geko opendmarc[895]: 5CD3F203CC8 ignoring
>Authentication-Results at 1 from geko.sbt.net.au
>Oct  9 08:33:31 geko opendmarc[895]: 5CD3F203CC8: SPF(mailfrom):
>blueoven.sa.com pass
>Oct  9 08:33:31 geko opendmarc[895]: 5CD3F203CC8: blueoven.sa.com pass
>Oct  9 08:33:31 geko postfix/qmgr[29319]: 5CD3F203CC8:
>from=<externally at blueoven.sa.com>, size=11832, nrcpt=1 (queue active)

Here is your 5-minute delay. It's possible that scanning took too much of 
time.
Perhaps too many concurrent amavis sessions?

I don't see any lines like:

Oct 11 00:00:50 mail amavis[24914]: (24914-15) LMTP [127.0.0.1]:10024
Oct 11 00:00:50 mail amavis[24914]: (24914-15) Checking: 


can you grep logs for 25835-11 ?

>Oct  9 08:38:31 geko amavis[25835]: (25835-11) Passed CLEAN
>{RelayedInbound}, [185.86.6.204]:2135 [185.86.6.204]
><externally at blueoven.sa.com> -> <ddd at tld.com.au>, Queue-ID: 5CD3F203CC8,
>Message-ID:
><KIQt7xgHBJqlLKPQnJDiqNdrLA0Uu2hhsOAol-kQdy0.f4MK1dAOOUevVLbF3NsfWTHAaObnFNnLu-oHKQFv5FA at blueoven.sa.com>,
>mail_id: Xcxoab4xOiX1, Hits: -0.649, size: 12276, queued_as: 65D2F203CD5,
>300377 ms


-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin, 1759