1

I sent an e-mail message from machine named syslog-server with command mail -s "syslog test" test@example.net <<< "test". The mail message was not delivered to receiver and following messages were logged to syslog-server log file:

Mar 11 13:16:06 syslog-server sendmail[30925]: u2BBG6mY030925: from=root, size=223, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, relay=root@localhost
Mar 11 13:16:06 syslog-server sm-mta[30931]: u2BBG6tO030931: from=<root@syslog-server>, size=461, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, proto=ESMTP, daemon=MTA-v4, relay=localhost [127.0.0.1]
Mar 11 13:16:07 syslog-server sendmail[30925]: u2BBG6mY030925: to=test@example.net, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30223, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (u2BBG6tO030931 Message accepted for delivery)
Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1
Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client: 30941:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3337:
Mar 11 13:16:07 syslog-server sm-mta[30941]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.example.com, reject=403 4.7.0 TLS handshake failed.
Mar 11 13:16:09 syslog-server sm-mta[30941]: STARTTLS=client, relay=mail.example.org., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: to=<test@example.net>, ctladdr=<root@syslog-server> (0/0), delay=00:00:03, xdelay=00:00:02, mailer=esmtp, pri=120461, relay=mail.example.org. [192.0.2.34], dsn=5.1.8, stat=User unknown
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG9tO030941: to=<root@syslog-server>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent

As I am new to e-mail, could somebody explain me what happened here? As I understand, in third log line my e-mail message was accepted for delivery, then there were multiple (failed) attempts to send e-mail message over TLS, but then the e-mail was sent and remote MTA reported back that user(test) at example.net is unknown?

  • 1
    Agreed - it's all in the log. What is the question? – Thomas Dickey Mar 11 '16 at 13:07
2

Log entries sets 1,2,3 are chained based on queueid.
Log entries set 4 is chained based on sendmail process id (pid).

1) Message is successfully passed to local main sendmail daemon at 127.0.0.1:25
QID=u2BBG6mY030925

Mar 11 13:16:06 syslog-server sendmail[30925]: u2BBG6mY030925: from=root, size=223, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, relay=root@localhost   
Mar 11 13:16:07 syslog-server sendmail[30925]: u2BBG6mY030925: to=test@example.net, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30223, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (u2BBG6tO030931 Message accepted for delivery)

2) Receiving server mail.example.org states that "recipient is unknown"
QID=u2BBG6tO030931

Mar 11 13:16:06 syslog-server sm-mta[30931]: u2BBG6tO030931: from=<root@syslog-server>, size=461, class=0, nrcpts=1, msgid=<201603111116.u2BBG6mY030925@syslog-server>, proto=ESMTP, daemon=MTA-v4, relay=localhost [127.0.0.1]  
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: to=<test@example.net>, ctladdr=<root@syslog-server> (0/0), delay=00:00:03, xdelay=00:00:02, mailer=esmtp, pri=120461, relay=mail.example.org. [192.0.2.34], dsn=5.1.8, stat=User unknown  
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown

3) Bounce mail (report about delivery problems) is sent to sender
QID=u2BBG9tO030941

Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG6tO030931: u2BBG9tO030941: DSN: User unknown  
Mar 11 13:16:09 syslog-server sm-mta[30941]: u2BBG9tO030941: to=<root@syslog-server>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent

4) There were problems with STARTLS (switching to encrypted connection)
PID=30941

Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client, error: connect failed=-1, SSL_error=1, errno=0, retry=-1  
Mar 11 13:16:07 syslog-server sm-mta[30941]: STARTTLS=client: 30941:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3337:  
Mar 11 13:16:07 syslog-server sm-mta[30941]: ruleset=tls_server, arg1=SOFTWARE, relay=mail.example.com, reject=403 4.7.0 TLS handshake failed.
Mar 11 13:16:09 syslog-server sm-mta[30941]: STARTTLS=client, relay=mail.example.org., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256  

Send as root a test message in verbose mode with SMTP session tracking to be 100% sure. STARTTLS problems and bad email domain used in sender address ("naked" host name) may lead to "misleading" log entries.

#!/bin/sh
/usr/sbin/sendmail -i -Am -v -- test@example.net <<END
Subject: test email subject

test email body
END

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.