• The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Resolved Outgoing mail control not working

tkalfaoglu

tkalfaoglu

Silver Pleskian
Someone's mail password was leaked and they sent thousands of spam thru that account.
I went into plesk and it says no account is exceeding their limits, in fact the Outgoing Mail Control page is empty as if no one is sending anything.. It does list thousangs of email addresses, but they apparently sent no mails :)

Google found some patches that I am not allowed to view - or have been removed since.

So, what to do?
Thanks, -t
 
Last edited:
First, check if those mails were really sent over your Plesk server. Do you see those mails in the logs?
How were the mails sent, via webmail or via SMTP?

Then, check the outgoing mail limits for the subscription that owns the domain. What limits do you have there?
 
Many thanks.. The account is set for 100 mails/hour.
But now no account seems to be counted.. I have the latest obsidian installed..
It seems somehow my postfix stopped counting outgoing mails :(

I have lots of entries like this:
Jan 27 04:35:09 jedi postfix/smtpd[3462]: CFB2A24A589E: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:10 jedi postfix/smtpd[3475]: EBF1724A3987: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:11 jedi postfix/smtpd[3472]: 3152D24A589F: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:11 jedi postfix/smtpd[3477]: 403C524A5890: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:11 jedi postfix/smtpd[3471]: 9E35D24A58A3: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:11 jedi postfix/smtpd[3476]: 9E7BD24A58A4: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:11 jedi postfix/smtpd[3473]: A09C924A58A5: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:12 jedi postfix/smtpd[3468]: 55E1124A57DA: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:12 jedi postfix/smtpd[38299]: 755A124A58A6: client=unknown[93.177.73.218], sasl_method=LOGIN, sasl_username=[email protected]
Jan 27 04:35:12 jedi postfix/smtpd[3474]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=15 rcpt=300 data=15 quit=1 commands=333
Jan 27 04:35:12 jedi postfix/smtpd[3462]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=15 rcpt=300 data=15 quit=1 commands=333
Jan 27 04:35:13 jedi postfix/smtpd[38299]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=16 rcpt=307 data=16 quit=1 commands=342
Jan 27 04:35:13 jedi postfix/smtpd[3475]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=9 rcpt=180 data=9 quit=1 commands=201
Jan 27 04:35:13 jedi postfix/smtpd[3472]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=12 rcpt=240 data=12 quit=1 commands=267
Jan 27 04:35:14 jedi postfix/smtpd[3477]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=12 rcpt=240 data=12 quit=1 commands=267
Jan 27 04:35:14 jedi postfix/smtpd[3471]: disconnect from unknown[93.177.73.218] ehlo=1 auth=1 mail=12 rcpt=240 data=12 quit=1 commands=267

and also:
Jan 27 04:04:17 jedi spamd[47560]: spamd: clean message (-1.0/7.0) for [email protected]:30 in 2.0 seconds, 8565 bytes.
Jan 27 04:04:17 jedi spamd[47560]: spamd: result: . 0 - LOTS_OF_MONEY,NO_RELAYS,TXREP,T_MONEY_PERCENT,URIBL_BLOCKED scantime=2.0,size=8565,user=[email protected],uid=30,required_score=7.0,rhost=l
ocalhost,raddr=127.0.0.1,rport=/var/run/spamd,mid=<[email protected]>,bayes=0.000000,autolearn=no autolearn_force=no,shortcircuit=no
Jan 27 04:04:17 jedi dovecot: service=lda, user=[email protected], ip=[]. Warning: Failed to parse return-path header
Jan 27 04:04:17 jedi spamd[47560]: spamd: using default config for [email protected]: /var/qmail/mailnames/marinbasim.com/uretim/.spamassassin/user_prefs
Jan 27 04:04:17 jedi dovecot: service=lda, user=[email protected], ip=[]. sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'
Jan 27 04:04:17 jedi postfix/pipe[46400]: B870B24A22AA: to=<[email protected]>, relay=plesk_virtual, delay=943, delays=0.25/935/0/8.3, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jan 27 04:04:17 jedi postfix-local[7587]: postfix-local: from=MAILER-DAEMON, to=[email protected], dirname=/var/qmail/mailnames
Jan 27 04:04:17 jedi spamd[47560]: spamd: processing message <[email protected]> for [email protected]:30
Jan 27 04:04:18 jedi spamd[42484]: spamd: clean message (-1.0/7.0) for [email protected]:30 in 2.0 seconds, 10028 bytes.
Jan 27 04:04:18 jedi spamd[42484]: spamd: result: . 0 - LOTS_OF_MONEY,NO_RELAYS,TXREP,T_MONEY_PERCENT,URIBL_BLOCKED scantime=2.0,size=10028,user=[email protected],uid=30,required_score=7.0,rhost=
localhost,raddr=127.0.0.1,rport=/var/run/spamd,mid=<[email protected]>,bayes=0.000000,autolearn=no autolearn_force=no,shortcircuit=no
Jan 27 04:04:18 jedi dovecot: service=lda, user=[email protected], ip=[]. Warning: Failed to parse return-path header
Jan 27 04:04:18 jedi spamd[45804]: spamd: using default config for [email protected]: /var/qmail/mailnames/marinbasim.com/uretim/.spamassassin/user_prefs
Jan 27 04:04:18 jedi spamd[42484]: spamd: using default config for [email protected]: /var/qmail/mailnames/marinbasim.com/uretim/.spamassassin/user_prefs
Jan 27 04:04:18 jedi postfix/qmgr[11095]: 66FAB24A16B0: from=<[email protected]>, size=5889, nrcpt=20 (queue active)
 
Do you see any entries in your maillog like "check-quota[6544]: Starting the check-quota filter..." ?

Please post some more log lines before and after this one:
Code: 
Jan 27 04:04:18 jedi postfix/qmgr[11095]: 66FAB24A16B0: from=<[email protected]>, size=5889, nrcpt=20 (queue active)
 
Is a pageful enough? this is
Jan 27 04:04:17 jedi postfix/smtp[22795]: 03B4424A297F: host gmail-smtp-in.l.google.com[64.233.189.27] said: 421-4.7.28 [95.217.102.163 15] Our system has detected an unusual rate of 421-4.7.28
unsolicited mail originating from your IP address. To protect our 421-4.7.28 users from spam, mail sent from your IP address has been temporarily 421-4.7.28 rate limited. Please visit 421-4.7.28 htt
ps://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.28 review our Bulk Email Senders Guidelines. l2si4516289pjw.19 - gsmtp (in reply to end of DATA command)
Jan 27 04:04:17 jedi postfix/smtp[54011]: connect to posta1.eps.rs[195.250.121.26]:25: Connection timed out
Jan 27 04:04:17 jedi postfix/smtp[62903]: ADC2E24A30A8: to=<[email protected]>, relay=mail.noviautoprevoz.rs[116.202.33.97]:25, delay=675, delays=2.7/672/0.19/0.53, dsn=2.0.0, status=sent (250
OK id=1ivsp7-000DVi-8C)
Jan 27 04:04:17 jedi postfix/smtp[23507]: ADC2E24A30A8: to=<[email protected]>, relay=mx2.beonet.net[91.223.162.21]:25, delay=675, delays=2.7/672/0.44/0.19, dsn=2.0.0, status=sent (250 2.0.0
Ok: queued as 934B28F95A)
Jan 27 04:04:17 jedi postfix/smtp[33679]: E5EBD24A22CD: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[64.233.189.27]:25, delay=854, delays=2.8/847/2.5/1.3, dsn=5.1.1, status=bo
unced (host gmail-smtp-in.l.google.com[64.233.189.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for
typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 Fix bounced or rejected emails - Gmail Help z9si5431217pju.15 - gsmtp (in reply to RCPT TO command))
Jan 27 04:04:17 jedi postfix/smtp[24083]: 7B6FF24A3093: to=<[email protected]>, relay=mta5.am0.yahoodns.net[98.136.96.76]:25, delay=675, delays=2.9/670/2/0.13, dsn=4.7.0, status=deferred (host mta
5.am0.yahoodns.net[98.136.96.76] said: 421 4.7.0 [TSS04] Messages from 95.217.102.163 temporarily deferred due to user complaints - 4.16.55.1; see Error: "421 4.7.0 [XXX] Messages from x.x.x.x temporarily deferred due to user complaints - 4.16.55.1" when sending email to Yahoo | Postmaster Help - SLN3434 (i
n reply to MAIL FROM command))
Jan 27 04:04:17 jedi postfix/smtp[36483]: A10FC24A2DDD: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[64.233.189.27]:25, delay=853, delays=2.8/847/2.5/1, dsn=5.1.1, status=bounce
d (host gmail-smtp-in.l.google.com[64.233.189.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typo
s or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 Fix bounced or rejected emails - Gmail Help y4si9906198plr.308 - gsmtp (in reply to RCPT TO command))
Jan 27 04:04:17 jedi postfix/pickup[6213]: D7ECE24A1734: uid=30 from=<MAILER-DAEMON>
Jan 27 04:04:17 jedi postfix/pipe[46400]: B870B24A22AA: to=<[email protected]>, relay=plesk_virtual, delay=943, delays=0.25/935/0/8.3, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jan 27 04:04:17 jedi postfix/qmgr[11095]: B870B24A22AA: removed
Jan 27 04:04:17 jedi postfix/cleanup[902]: D7ECE24A1734: message-id=<[email protected]>
Jan 27 04:04:17 jedi postfix-local[7587]: postfix-local: from=MAILER-DAEMON, to=[email protected], dirname=/var/qmail/mailnames
Jan 27 04:04:17 jedi postfix/smtp[18498]: ADC2E24A30A8: to=<[email protected]>, relay=web2.en.rs[79.101.44.3]:25, delay=675, delays=2.7/672/0.39/0.19, dsn=5.1.1, status=bounced (host web2.en.rs[79.101
.44.3] said: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table (in reply to RCPT TO command))
Jan 27 04:04:17 jedi spamd[47560]: spamd: processing message <[email protected]> for [email protected]:30
Jan 27 04:04:17 jedi postfix/smtp[33679]: E5EBD24A22CD: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[64.233.189.27]:25, delay=854, delays=2.8/847/2.5/1.4, dsn=5.1.1, status=bounc
ed (host gmail-smtp-in.l.google.com[64.233.189.27] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typ
os or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 Fix bounced or rejected emails - Gmail Help z9si5431217pju.15 - gsmtp (in reply to RCPT TO command))
Jan 27 04:04:18 jedi spamassassin[7604]: Starting the spamassassin filter...
Jan 27 04:04:18 jedi spamd[10387]: spamd: processing message <[email protected]10.PROD.OUTLOOK.COM> for [email protected]:30
Jan 27 04:04:18 jedi postfix/smtp[48492]: 7B6FF24A3093: to=<[email protected]>, relay=ASPMX.L.GOOGLE.com[64.233.188.26]:25, delay=676, delays=2.9/670/2.5/0.66, dsn=5.2.2, status=bounced (host ASPMX.L.GOOGLE.com[64.233.188.26] said: 552-5.2.2 The email account that you tried to reach is over quota. Please direct 552-5.2.2 the recipient to 552 5.2.2 Clear Google Drive space & increase storage - Gmail Help j1si10002283plk.126 - gsmtp (in reply to RCPT TO command))
Jan 27 04:04:18 jedi postfix/smtp[46922]: 9806E24A25C6: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[2404:6800:4008:c07::1a]:25, delay=1344, delays=1109/228/6.4/1, dsn=4.7.28, status=deferred (host gmail-smtp-in.l.google.com[2404:6800:4008:c07::1a] said: 421-4.7.28 [2a01:4f9:2a:268b::2 15] Our system has detected an unusual rate 421-4.7.28 of unsolicited mail originating from your IP address. To protect our 421-4.7.28 users from spam, mail sent from your IP address has been temporarily 421-4.7.28 rate limited. Please visit 421-4.7.28 Prevent mail to Gmail users from being blocked or sent to spam - Gmail Help to 421 4.7.28 review our Bulk Email Senders Guidelines. o7si10241387pfg.128 - gsmtp (in reply to end of DATA command))
Jan 27 04:04:18 jedi postfix/qmgr[11095]: D7ECE24A1734: from=<>, size=9624, nrcpt=1 (queue active)
Jan 27 04:04:18 jedi postfix/cleanup[30868]: D197824A15F0: message-id=<>
Jan 27 04:04:18 jedi postfix/cleanup[42439]: E54AF24A16D7: message-id=<>
:
 
Monty said:
Do you see any entries in your maillog like "check-quota[6544]: Starting the check-quota filter..." ?

Please post some more log lines before and after this one:
Code: 
Jan 27 04:04:18 jedi postfix/qmgr[11095]: 66FAB24A16B0: from=<[email protected]>, size=5889, nrcpt=20 (queue active)
Click to expand...

And yes I see check-quota blurbs:

[root@jedi new]# grep check-quota /var/log/maillog|more
Jan 27 04:04:17 jedi check-quota[7537]: Starting the check-quota filter...
Jan 27 04:04:17 jedi journal: plesk sendmail[7535]: SKIP during call 'check-quota' handler
Jan 27 04:04:18 jedi check-quota[7722]: Starting the check-quota filter...
Jan 27 04:04:18 jedi journal: plesk sendmail[7719]: SKIP during call 'check-quota' handler
Jan 27 04:04:20 jedi check-quota[8043]: Starting the check-quota filter...
Jan 27 04:04:20 jedi journal: plesk sendmail[8042]: SKIP during call 'check-quota' handler
Jan 27 04:04:20 jedi check-quota[8062]: Starting the check-quota filter...
Jan 27 04:04:20 jedi journal: plesk sendmail[8061]: SKIP during call 'check-quota' handler
Jan 27 04:04:23 jedi check-quota[8672]: Starting the check-quota filter...
Jan 27 04:04:23 jedi journal: plesk sendmail[8668]: SKIP during call 'check-quota' handler
Jan 27 04:04:23 jedi check-quota[8671]: Starting the check-quota filter...
Jan 27 04:04:23 jedi journal: plesk sendmail[8666]: SKIP during call 'check-quota' handler
Jan 27 04:04:23 jedi check-quota[8699]: Starting the check-quota filter...
Jan 27 04:04:23 jedi journal: plesk sendmail[8688]: SKIP during call 'check-quota' handler
Jan 27 04:04:25 jedi check-quota[9039]: Starting the check-quota filter...
Jan 27 04:04:25 jedi journal: plesk sendmail[9037]: SKIP during call 'check-quota' handler
Jan 27 04:04:26 jedi check-quota[9200]: Starting the check-quota filter...
Jan 27 04:04:26 jedi journal: plesk sendmail[9199]: SKIP during call 'check-quota' handler
Jan 27 04:04:26 jedi check-quota[9296]: Starting the check-quota filter...
Jan 27 04:04:26 jedi journal: plesk sendmail[9295]: SKIP during call 'check-quota' handler
Jan 27 04:04:27 jedi check-quota[9429]: Starting the check-quota filter...
Jan 27 04:04:27 jedi journal: plesk sendmail[9427]: SKIP during call 'check-quota' handler
Jan 27 04:04:27 jedi check-quota[9569]: Starting the check-quota filter...
Jan 27 04:04:27 jedi journal: plesk sendmail[9568]: SKIP during call 'check-quota' handler
Jan 27 04:04:29 jedi check-quota[9773]: Starting the check-quota filter...
Jan 27 04:04:29 jedi journal: plesk sendmail[9772]: SKIP during call 'check-quota' handler
Jan 27 04:04:29 jedi check-quota[9803]: Starting the check-quota filter...
Jan 27 04:04:29 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
Jan 27 04:04:29 jedi check-quota[9852]: Starting the check-quota filter...
Jan 27 04:04:29 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
Jan 27 04:04:29 jedi check-quota[9870]: Starting the check-quota filter...
Jan 27 04:04:29 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
Jan 27 04:04:29 jedi check-quota[9935]: Starting the check-quota filter...
Jan 27 04:04:29 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
Jan 27 04:04:30 jedi check-quota[9984]: Starting the check-quota filter...
Jan 27 04:04:30 jedi journal: plesk sendmail[9982]: SKIP during call 'check-quota' handler
Jan 27 04:04:30 jedi check-quota[9989]: Starting the check-quota filter...
Jan 27 04:04:30 jedi check-quota[9994]: Starting the check-quota filter...
Jan 27 04:04:30 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
Jan 27 04:04:30 jedi psa-pc-remote[17964]: SKIP during call 'check-quota' handler
--More--
 
And just to make sure: What do you have in Tools & Settings => Mail Server Settings => Whitelist ?
 
Monty said:
And just to make sure: What do you have in Tools & Settings => Mail Server Settings => Whitelist ?
Click to expand...
I only have:
Entries
sort-up.gif
127.0.0.0 / 8
95.216.38.116 / 32
95.216.90.224 / 29
::1 / 128
 
You must log in or register to reply here.

Similar threads

P
Outgoing Mail Control permission denied on CentOS
Replies
8
Views
475
Sebahat.hadzhi
Sebahat.hadzhi
nethubonline
Issue Failed to reset statistics for mail exceed limit
Replies
7
Views
9K
AlmaWalters
A
datea.services
Question Attempts to exceed outgoing limits: log of mails not sent
Replies
4
Views
1K
Peter Debik
P
K
Resolved Outgoing mail control does not work for emails sent from web scripts?
Replies
2
Views
1K
Kroptokin
K
Cordal
Resolved stop sending spam
Replies
12
Views
2K
Change Maker
C
Back
Top