Mail forwarding loop

[Tozz]

Since today, 17 march 2016 about 10:45 CET we are seeing mail bounces for random users on random mails. Not all mail is bounced. Bounce message is: "status=bounced (mail forwarding loop for [email protected])"

We are seeing this on all our Plesk machines since today, 10:45 CET.

The logs do not give any insights on the reason why there is a mail loop. We dont see anything wrong with the configuration and because not all e-mail is bounced it seems like external factors are involved.

Is anyone else seeing this?

 

[Tozz]

Some extra details:
- The mail address that has these issues does not have any forwarding configured in Plesk. They are regular mailboxes.
- Running mchk does not solve the issue.
- Issue has been seen on atleast 15 machines.
- The issue is also seen with outgoing mail to external addresses

 

[LinqLOL]

Hi toz. Are u using spamexperts by any chance too? We are seeing This problem too but only when using spamexperts.

 

[Tozz]

Hi. Glad to hear we're not the only one. We are not using SpamExperts. How are you using SpamExperts? Is the MX for the troubling domain directed to SpamExperts? Or is it something else? Maybe we can atleast pinpoint a little bit more?

 

[Tozz]

Upon closer inspection, it looks like all the troubling e-mail is coming from Ziggo. That means either the sending SMTP server is Ziggo, or it is an Ziggo customer that is trying to send e-mail over our SMTP service.

 

[Tozz]

LinqHost: Could you please verify? It looks to me like Ziggo has changed their infrastructure, so that it adds a new header "Delivered-To". This header leads Postfix to believe the mail is already delivered, returning mail forwarding loop.

 

[LinqLOL]

Yes i can confirm it's ziggo only customers

So not a plesk problem, our directadmin servers have the same problem.

 

[Tozz]

I can now confirm Ziggo wrongly adds "Delivered-To" headers into their mail (confirmed by traffic sniffing). I'll try to contact Ziggo, but I have very little hope this will work

 

[Tozz]

Ziggo is now aware of and has confirmed the issue.

 

[LinqLOL]

Sweet, thanks tozz!

 

[Tozz]

Ziggo has just resolved the issue, I can confirm the issue is resolved.

 

[Tozz]

If you have set "soft_bounce" to yes, as we did.. This might help you:

find /var/spool/postfix/deferred/ -type f -print | xargs -I {} sed -i "s/Delivered-To/DankZiggo-To/g" {} && sed -i "s/^soft_bounce = yes/soft_bounce = no/g" /etc/postfix/main.cf && postsuper -r ALL && /etc/init.d/postfix restart

 

[Rick M]

Thanks for the info Tozz! I've been trying to find the cause for hours, can confirm that the issue has been resolved over here as well.