Issue Charming strange SMTP issues

[seqoi]

Ok recently i added another customer on to my server and we have issues i simply can not debug.

Here is strange issue. When sending "new" emails from Outlook they are just fine. They are being sent (and they are not marked as spam).

But whenever client use Forward or Reply function all these emails are being undelivered ?!? As soon as he send them they return as being undelivered and or blocked by spamhaus.

Or like this one

The following recipient(s) cannot be reached:

'John Smith' on 30.8.2017 11:00

554 5.7.1 <93-555-55-91.kkk.net.t-com.hr[some ip here]>: Client host rejected: Access denied

What the heck?? So only when replying or forwarding his messages are sent as spam. This is driving me crazy.

When i use authentication checker at https://www.port25.com/authentication-checker/

i am getting these results (keys altered my domain and ip are altered for security reasons)

This message is an automatic response from Port25's authentication verifier
service at verifier.port25.com.  The service allows email senders to perform
a simple check of various sender authentication mechanisms.  It is provided
free of charge, in the hope that it is useful to the email community.  While
it is not officially supported, we welcome any feedback you may have at
<[email protected]>.

Thank you for using the verifier,

The Port25 Solutions, Inc. team

==========================================================
Summary of Results
==========================================================
SPF check:          pass
DKIM check:         pass
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  my-domain-washere
Source IP:      myipnumberwashere
mail-from:      [email protected]

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         pass
ID(s) verified: [email protected]

DNS record(s):
    sometestdomain.com. 1122 IN TXT "v=spf1 +a +mx +a:sometestdomain.com -all"
    sometestdomain.com. 1122 IN TXT "google-site-verification=mykeyhere"
    sometestdomain.com. 965 IN A myipnumberwashere


----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         pass (matches From: [email protected])
ID(s) verified: header.d=sometestdomain.com

Canonicalized Headers:
    to:[email protected]'0D''0A'
    from:Site'20'Test'20'<[email protected]>'0D''0A'
    subject:test'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'c=relaxed/relaxed;'20'd=sometestdomain.com;'20's=default;'20't=1504166584;'20'bh=key+/TImW+5JC6456456z46G3hSuFU=;'20'l=0;'20'h=To:From:Subject;'20'b=

Canonicalized Body:

DNS record(s):
    default._domainkey.sometestdomain.com. 1072 IN TXT "v=DKIM1; t=s; p=kkkkeeeyyye4E2nur517FS92PNDzPWu+L0sTr30uqwAqsanwJD92Wi4vx33Sv3PdBc5hxdMT1KrtH0bsd6gvQbdvPVEKBgegeggeffefgegTAT4JwWC03oOoiKqVlzQIDAQAB"

Public key used for verification: default._domainkey.sometestdomain.com (1024 bits)

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.4.1 (2015-04-28)

Result:         ham (-2.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 NO_DNS_FOR_FROM        DNS: Envelope sender has no MX or A DNS records
 0.0 T_SPF_TEMPERROR        SPF: test of record failed (temperror)
 0.0 T_SPF_HELO_TEMPERROR   SPF: test of HELO record failed (temperror)
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0005]
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                            domain
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature



==============================================================
Explanation of the possible results (based on RFCs 7601, 7208)
==============================================================


DKIM Results
============


SPF Results
===========

none:  Either (a) no syntactically valid DNS domain name was extracted from
    the SMTP session that could be used as the one to be authorized, or
    (b) no SPF records were retrieved from the DNS.

neutral:  The ADMD has explicitly stated that it is not asserting whether
    the IP address is authorized.

pass:  An explicit statement that the client is authorized to inject mail
    with the given identity.

fail:  An explicit statement that the client is not authorized to use the
    domain in the given identity.

softfail:  A weak statement by the publishing ADMD that the host is probably
    not authorized.  It has not published a stronger, more definitive policy
    that results in a "fail".

temperror:  The SPF verifier encountered a transient (generally DNS) error
    while performing the check.  A later retry may succeed without further
    DNS operator action.

permerror: The domain's published records could not be correctly interpreted.
    This signals an error condition that definitely requires DNS operator
    intervention to be resolved.


"iprev" Results
===============

pass:  The DNS evaluation succeeded, i.e., the "reverse" and
    "forward" lookup results were returned and were in agreement.

fail:  The DNS evaluation failed.  In particular, the "reverse" and
    "forward" lookups each produced results, but they were not in
    agreement, or the "forward" query completed but produced no
    result, e.g., a DNS RCODE of 3, commonly known as NXDOMAIN, or an
    RCODE of 0 (NOERROR) in a reply containing no answers, was
    returned.

temperror:  The DNS evaluation could not be completed due to some
    error that is likely transient in nature, such as a temporary DNS
    error, e.g., a DNS RCODE of 2, commonly known as SERVFAIL, or
    other error condition resulted.  A later attempt may produce a
    final result.

permerror:  The DNS evaluation could not be completed because no PTR
    data are published for the connecting IP address, e.g., a DNS
    RCODE of 3, commonly known as NXDOMAIN, or an RCODE of 0 (NOERROR)
    in a reply containing no answers, was returned.  This prevented
    completion of the evaluation.  A later attempt is unlikely to
    produce a final result.




==========================================================
Original Email
==========================================================

Return-Path: <[email protected]>
Received: from my-domain-washere (myipnumberwashere) by verifier.port25.com id hkv1bi2bkd0i for <[email protected]>; Thu, 31 Aug 2017 04:03:05 -0400 (envelope-from <[email protected]>)
Authentication-Results: verifier.port25.com; spf=pass  [email protected];
 dkim=pass (matches From: [email protected])  header.d=sometestdomain.com
Received: from [xxx.168.88.xxx] (unknown [xxx.61.158.37])
    by my-domain-washere (Postfix) with ESMTPSA id 951BC1C6B8A
    for <[email protected]>; Thu, 31 Aug 2017 10:03:04 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sometestdomain.com;
    s=default; t=1504166584;
    bh=key+/TImW+5JC46666G3hSuFU=; l=0;
    h=To:From:Subject;
    b=vY466Vgi+464646m9WAFW5mJx7YRk28GyEZoLAMBF9cGPaWwf
     iT3W/KgtlX146466464646KApFIUia24PWuuT60pxKV5E0tfTkJP
     KIUNcJIquFFRg5jo6xRfm1aOXhlLuUuxHzu89NZ8=
Received-SPF: pass (connection is authenticated)
To: [email protected]
From: Site Test <[email protected]>
Subject: test
Message-ID: <[email protected]>
Date: Thu, 31 Aug 2017 10:03:06 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
X-PPP-Message-ID: <20170831080304.12753.34192@my-domain-washere>
X-PPP-Vhost: sometestdomain.com

Could this be error?

SpamAssassin v3.4.1 (2015-04-28)

Result: ham (-2.0 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS records
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

?

Any clue please help!!

 

[mow]

Look in /var/log/maillog for the actual errors and post them here.
Are you sure Outlook sends those through the correct server?

 

[seqoi]

I apologize for not being detailed in initial post. Plesk on Centos is used (so there is no /var/log/maillog folder) so my log files are in /usr/local/psa/var/log/maillog (postfix service) but there is no any error in log file related to my issue. As i said mail is being sent! It's just that it is returned as undelivered with the Client host rejected: Access denied - and as i said this is happening only when using Forward or Reply so i am confused. Outlook sends through correct server i myself double checked that. To repeat myself: when sending "new" messages they are delivered correctly. No problem there. Just Forward and Reply goes to Spam or Undelivered. Thunderbird same problem.

Dkim, Dmarc, SPF all pass every test. It's not that. I am sure it's something ubiquitous damn...

Any ideas?

I found this so far : Cannot send email using Outlook: 554 5.7.1: Client host rejected: Access denied but there is literally none of these lines to be found in my Postifx configuration file - they are simply not there - i did not removed it installation is at default and these values mentioned in article are not there.

On top of that i don't want to mess with Postifx configuration because as i see it other clients (at various subscriptions) on server does not have this problem. Just this one..damn could it be i messed something with setting up DNS zones? I doubt it. Is there any online decent tool which can tell me if something is wrong?

 

[Bitpalast]

Try mxtoolbox.com to analyze what is going on.

 

[seqoi]

Try mxtoolbox.com to analyze what is going on.

Thanks Peter. Did not knew for this website.

Posting results here. Dunno why it is displaying this error. See screenshot 1 and 2. Since i added MX records in my DNS zone (cloudns). Domain name starting with letter "s" is blurred for security reason so are IP numbers and keys. If you want clear picture just say it here..

EDIT: i sent you more detailed DNS zone in to conversation