Postfix Connections lost (inbound)

Should I be concerned with the info below? I have 3 email accounts on this server, two are barely used.

3178 Connections

3019 Connections lost (inbound)

3178 Disconnections

"96 Sent via LMTP" seems odd, I only sent about 20 emails yesterday.

Seems from info, thats about 145 connections per hour or 2.5 per minute. My phone is set to check email every 15 mins.

I didn't send any attachments, I did receive a few, but no more than 2mb total.

Logwatch info:

Postfix
     16   Miscellaneous warnings  
  7.671M  Bytes accepted                           8,043,717
222.645K  Bytes sent via SMTP                        227,988
  3.680M  Bytes sent via LMTP                      3,858,276
  3.774M  Bytes delivered                          3,957,453
========   ==================================================
    230   Accepted                                    82.14%
     50   Rejected                                    17.86%
--------   --------------------------------------------------
    280   Total                                      100.00%
========   ==================================================
      2   5xx Reject HELO/EHLO                         4.00%
      1   5xx Reject unknown user                      2.00%
     47   5xx Reject RBL                              94.00%
--------   --------------------------------------------------
     50   Total 5xx Rejects                          100.00%
========   ==================================================
      3   4xx Reject sender address                  100.00%
--------   --------------------------------------------------
      3   Total 4xx Rejects                          100.00%
========   ==================================================
   3178   Connections            
   3019   Connections lost (inbound)
   3178   Disconnections          
    229   Removed from queue      
    113   Delivered              
     20   Sent via SMTP          
     96   Sent via LMTP          
      1   Timeouts (inbound)      
      1   Hostname verification errors (FCRDNS)
     20   SASL authenticated messages 

10 Replies

What shows up in your log file for those lost connections? Might be anything from spammers pre-emptively blocked to static electricity on your antenna.

On my other Linode, it is set to only have postfix to enable sending of php forms on a few sites. All forms send email fine. This Linode doesn't handle any inbound email, port 25 is closed. I'm not sure what all the deferrals and connection failures are coming from. I've followed info on postfix settings for null client. Is it the system trying to send notices failing? I've set root to have a real email alias and ran newaliases, but I still don't get any email notifications at that email Flushed postfix que and deferrred que, ran logwatch and got almost same info as below.

Sample from mail log:

Oct 11 16:21:59 linode123 postfix/smtp[9760]: connect to linode123.mydomain.com[4321:3c03::f03c:91ff:fe69:4321]:25: Connection refused 

Oct 11 16:21:59 linode123 postfix/smtp[9760]: D6E8621FE6: to=<root@linode123.mydomain.c om="">, relay=none, delay=17699, delays=17699/0.02/0/0, dsn=4.4.1, status=deferred (connect to linode123 .mydomain.com[4321:3c03::f03c:91ff:fe69:4321]:25: Connection refused)</root@linode123.mydomain.c> 
Postfix

****** Summary ******************************************************************************** *****
 48.796K  Bytes accepted                              49,967
 18.314K  Bytes sent via SMTP                         18,754
========   ==================================================
     50   Accepted                                   100.00%
--------   --------------------------------------------------
     50   Total                                      100.00%
========   ==================================================
      1   Removed from queue      
      1   Sent via SMTP          
    176   Deferred                
   3293   Deferrals              
   1430   Connection failures (outbound)
****** Detail (1) ******************************************************************************** **
      1   Sent via SMTP ---------------------------------------------------------------------------
      1      mydomain.com
   3293   Deferrals -------------------------------------------------------------------------------
   3293      4.4.1: Transient failure: Network & routing status: No answer from host
   2578         Delivery temporarily suspended: Connection refused
   2578            linode123.mydomain.com
   2578               root
   1301                  123.265.91.26    linode123.mydomain.com
   1277                  4321:3c03::f03c:91ff:fe69:4321  linode123.mydomain.com
    715         Connection refused
    715            linode123.mydomain.com
    715               root
    382                  123.265.91.26    linode123.mydomain.com
    333                  4321:3c03::f03c:91ff:fe69:4321  linode123.mydomain.com
   1430   Connection failures (outbound) ----------------------------------------------------------
   1430      Connection refused
    715         4321:3c03::f03c:91ff:fe69:4321  linode123.mydomain.com
    715         123.265.91.26    linode123.mydomain.com
=== Delivery Delays Percentiles ============================================================
                   0%       25%       50%       75%       90%       95%       98%      100%
-------------------------------------------------------------------------------- ------------
Before qmgr       0.01  55076.00 126476.00 197876.00 239876.00 260876.00 281875.14 307077.00
In qmgr           0.01      0.04      5.10      5.20      5.20      5.30      8.10      8.20
Conn setup        0.00      0.00      0.00      0.00      5.10      5.20      8.10     14.00
Transmission      0.00      0.00      0.00      0.00      0.00      0.00      0.01      0.20
Total             0.03  55082.00 126481.00 197881.00 239881.00 260881.00 281876.14 307077.00
================================================================================ ============

Sounds like a problem with your postfix configuration. Can you post the contents of /etc/postfix/main.cnf and don't omit your real domain, it doesn't help us.

/etc/postfix/main.cf
> myhostname = linode334443.eliteventuremedia.com

mydomain = eliteventuremedia.com

myorigin = $myhostname

inet_interfaces = loopback-only

mydestination =

smtpdbanner = $myhostname ESMTP $mailname (Debian/GNU)

biff = no

appenddotmydomain = no

readme_directory = no

relayhost =

relay_domains =

mynetworks_style = host

local_transport = error:local delivery is disabled

smtptlssecurity_level = may

Note - "mydomain = eliteventuremedia.com" value is not correct, thats actually the value used on my other linode. This linode has several domains, so should this be an empty value?

Sample mail log
> Oct 11 22:05:55 linode334443 postfix/qmgr[12144]: 99EBB21F10: from=<root@linode334443.eliteventuremedia.com>, size=870, nrcpt=1 (queue active)

Oct 11 22:05:55 linode334443 postfix/smtp[12991]: connect to linode334443.eliteventuremedia.com[2600:3c03::f03c:91ff:fe69:65db]:25: Connection refused

Oct 11 22:05:55 linode334443 postfix/smtp[12991]: connect to linode334443.eliteventuremedia.com[192.155.91.26]:25: Connection refused

Oct 11 22:05:55 linode334443 postfix/smtp[12991]: 99EBB21F10: to=<root@linode334443.eliteventuremedia.com>, orig_to=, relay=none, delay=8814, delays=8814/0.02/0.19/0, dsn=4.4.1, status=deferred (connect to linode334443.eliteventuremedia.com[192.155.91.26]:25: Connection refused)

It's now up to 5081 Deferrals.

mydestination = is probably your problem. Postfix doesn't know that it should send mail to your linode using lmtp instead of smtp. Also your missing a mynetworks line which normally looks like this````
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

This````
local_transport = error:local delivery is disabled

also looks wrong. Just delete the line so it returns to the default local.

To be honest your main.cf looks a bit weird, this is one of mine

myhostname = mail.rwky.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mail.rwky.net, localhost.rwky.net, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only

````
3293 Deferrals

From the logs, I can see that the deferrals are happening when an email is being sent to anything @ eliteventuremedia.com, as in this example:

Oct 19 20:17:05 linode334443 postfix/pickup[5563]: B97D921F0F: uid=0 from= Oct 19 20:17:05 linode334443 postfix/cleanup[5662]: B97D921F0F: message-id=20131020001705.B97D921F0F@linode334443.eliteventuremedia.com Oct 19 20:17:05 linode334443 postfix/qmgr[5565]: B97D921F0F: from=root@linode334443.eliteventuremedia.com, size=515, nrcpt=1 (queue active) Oct 19 20:17:35 linode334443 postfix/smtp[5651]: connect to mail.eliteventuremedia.com[69.164.213.78]:25: Connection timed out Oct 19 20:17:35 linode334443 postfix/smtp[5651]: B97D921F0F: to=, relay=none, delay=30, delays=0.01/0/30/0, dsn=4.4.1, status=deferred (connect to mail.eliteventuremedia.com[69.164.213.78]:25: Connection timed out)
````

eliteventuremedia.com (fqdn = linode321621.eliteventuremedia.com) is a different linode/ip than linode334443.eliteventuremedia.com, but there is a DNS record for linode334443.eliteventuremedia.com pointing to the ip of the linode with all the deferrals.

From what I found, when an email from linode334443 is being sent to anything@eliteventuremedia.com, it looks up the MX record for linode334443.eliteventuremedia.com, doesn't find one, so then goes to the mx record for eliteventuremedia.com, which will not let it connect.

eliteventuremedia.com has an mx and can send and recieve mail fine. linode334443.eliteventuremedia.com is only used to send from wordpress forms, so there is no mx. It has several domains on it, but they use thirdparty email.

Anything I can do to linode334443.eliteventuremedia.com so it can send mail to anything@eliteventuremedia.com? I think it would just be for notifications from the system. root has an alias of hosting @ eliteventuremedia.com for this purpose. Also, why in the logs, do we see emails like root@linode334443.eliteventuremedia.com when they emails at fqdn don't exist?

Now that I think of it, linode334443.eliteventuremedia.com was able to send logwatch emails each day to hosting @ eliteventuremedia.com and today it can't. I just manually ran logwatch and I don't get the email and see the error in mail log for:

Oct 19 21:14:15 linode334443 postfix/qmgr[7611]: 5E5A221F13: from=<root@linode334443.eliteventuremedia.com>, size=14672, nrcpt=1 (queue active)
Oct 19 21:14:45 linode334443 postfix/smtp[7620]: connect to mail.eliteventuremedia.com[69.164.213.78]:25: Connection timed out
Oct 19 21:14:45 linode334443 postfix/smtp[7620]: 5E5A221F13: to=<hosting@eliteventuremedia.com>, relay=none, delay=527, delays=496/0.02/30/0, dsn=4.4.1, status=deferred (connect to mail.eliteventuremedia.com[69.164.213.78]:25: Connection timed out)</hosting@eliteventuremedia.com></root@linode334443.eliteventuremedia.com> 

Can't think of what could have changed to cause this.

Today, my last message issue is resolved by itself.

"Now that I think of it, linode334443.eliteventuremedia.com was able to send logwatch emails each day to hosting @ eliteventuremedia.com and today it can't. "

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct