2

I sent an e-mail message from machine named syslog-server with command mail -s "syslog test" [email protected] <<< "test". The mail message was not delivered to receiver and following messages were logged to syslog-server log file:

Mar 11 13:16:06 syslog-server sendmail[30925]: u2BBG6mY030925: from=root, size=223, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, relay=root@localhost
Mar 11 13:16:06 syslog-server sm-mta[30931]: u2BBG6tO030931: from=<root@syslog-server>, size=461, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, proto=ESMTP, daemon=MTA-v4, relay=localhost [127.0.0.1]
Mar 11 13:16:07 syslog-server sendmail[30925]: u2BBG6mY030925: [email protected], ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30223, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (u2BBG6tO030931 Message accepted for delivery)
Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1
Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client: 30941:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3337:
Mar 11 13:16:07 syslog-server sm-mta[30941]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.example.com, reject=403 4.7.0 TLS handshake failed.
Mar 11 13:16:09 syslog-server sm-mta[30941]: STARTTLS=client, relay=mail.example.org., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: to=<[email protected]>, ctladdr=<root@syslog-server> (0/0), delay=00:00:03, xdelay=00:00:02, mailer=esmtp, pri=120461, relay=mail.example.org. [192.0.2.34], dsn=5.1.8, stat=User unknown
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG9tO030941: to=<root@syslog-server>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent

As I am new to e-mail, could somebody explain me what happened here? As I understand, in third log line my e-mail message was accepted for delivery, then there were multiple (failed) attempts to send e-mail message over TLS, but then the e-mail was sent and remote MTA reported back that user(test) at example.net is unknown?

1
  • 1
    Agreed - it's all in the log. What is the question? Mar 11, 2016 at 13:07

1 Answer 1

4

Log entries sets 1,2,3 are chained based on queueid.
Log entries set 4 is chained based on sendmail process id (pid).

  1. Message is successfully passed to local main sendmail daemon at 127.0.0.1:25
    QID=u2BBG6mY030925 (QUID_at_127.0.0.1=u2BBG6tO030931)

Mar 11 13:16:06 syslog-server sendmail[30925]: u2BBG6mY030925: from=root, size=223, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, relay=root@localhost

Mar 11 13:16:07 syslog-server sendmail[30925]: u2BBG6mY030925: [email protected], ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30223, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (u2BBG6tO030931 Message accepted for delivery)

  1. Receiving server mail.example.org states that "recipient is unknown"
    QID=u2BBG6tO030931 (QID_of_bounce=u2BBG9tO030941)

Mar 11 13:16:06 syslog-server sm-mta[30931]: u2BBG6tO030931: from=<root@syslog-server>, size=461, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, proto=ESMTP, daemon=MTA-v4, relay=localhost [127.0.0.1]

Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: [email protected], ctladdr=<root@syslog-server> (0/0), delay=00:00:03, xdelay=00:00:02, mailer=esmtp, pri=120461, relay=mail.example.org. [192.0.2.34], dsn=5.1.8, stat=User unknown

Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown

  1. Bounce mail (report about delivery problems) is sent to sender
    QID=u2BBG9tO030941 about delivery of u2BBG6tO030931

Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown

Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG9tO030941: to=<root@syslog-server>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent

  1. There were problems with STARTLS (switching to encrypted connection)
    PID=30941

Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1

Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client: 30941:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3337:

Mar 11 13:16:07 syslog-server sm-mta[30941]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.example.com, reject=403 4.7.0 TLS handshake failed.

Mar 11 13:16:09 syslog-server sm-mta[30941]: STARTTLS=client, relay=mail.example.org., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256


Send as root a test message in verbose mode with SMTP session tracking to be 100% sure. STARTTLS problems and bad email domain used in sender address ("naked" host name) may lead to "misleading" log entries.

#!/bin/sh
/usr/sbin/sendmail -i -Am -v -- [email protected] <<END
Subject: test email subject

test email body
END

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .