Debugging a "sendmail" issue

Basically I am trying to track down the cause of a problem when using sendmail. It seems to work fine to the majority of hosts, however there is a problem which one recipient (lets say hick@jimbob.com) is not getting the emails.

Something to note, when I tried pinging jimbob.com (domain used in the email address) it does not give any results. However the internet browser is able to open the website of jimbob.com, and outlook is able to successfully send to hick@jimbob.com.

Which makes me think this is down to a problem within sendmail. Anyone idea's on how to diagnose this issue?

Appreciate any helpful replies.

Let's start with jimbob... smtp uses port 25, if jimbob.com is alive on that port this will show it:

ping -p 25 jimbob.com

Do the emails to jimbob show up in the user's dead.letter file? If not, the problem is outside your sphere of control.

Will definitely try that in the morning. Thought it was very odd not being able to ping it even though their web and mail (from outlook) was receiving traffic fine.

I sent a test email using sendmail yesterday, I'm not exactly sure about "dead.letter" but they were scanning their mail log files and they never seen any existence of the mail getting through (or even any activity from our domain).

Is there anything I can do to verify it is not at my end? Perhaps try to trace where the sendmail is taking my message in each hop and see where it drops off? I would like to know for sure it is leaving our space and is sent to them, if that makes sense. Just not sure how to go about doing this....

This could be caused by a firewall, which cuts off ICMP traffic. This is rather common these days, even if it is bad firewalling style to do so.

Another idea, unrelated to this: did you check the MX records for the domain jimbob.com and have you checked that the mail exchanger is working?

I hope this helps.

bakunin

Anything useful in the /var/log/maillog, like a code 250 (sendmail success), or a timeout, or name unresolved?

cat /var/log/maillog | grep jimbob.com

I'm not ruling that out either... but as ya know I have to rule other options out first in this situation. And that means doing some stalking on that mail and finding out where the bread crumb trail finishes. Just not sure how to go about doing this form of tracking.

I checked the MX record and it showed the mail servers as some amateurish outfit, when I looked at their website - but I'm not one to judge a book by its cover :slight_smile:

How would I confirm that the mail exchanger is working? Is that where I telnet into it?

I looked for a log file, but didn't manage to find it at the time. I will check that directory location tomorrow, but if it isn't there is there a way to create one temporarily for sendmail?

On most Linux systems, sendmail will default to that location, but it may be setup elsewhere (check your sendmail.mc or sendmail.cf for location).

Cheers I will have a look when I get in tomorrow, any additional light bulb moments are welcome, more things I can try the better :slight_smile:

Do sendmail tries to *send* it? You should be able to check that on the /var/log/mail* (last resort tcpdump -i if -n port 25 on the server or the equivalent snoop)
Do others users on the jimbob.com get their email?

How did you ping it? ping jimbob.com ? It might not be the correct ip.
When an MTA tries to send an email, it asks for the MX dns record.
It usually points to smtp||mail.domain.tld, but could be any other name/address
Try something like
dig domain.tld MX
to ask for the MaileXchanger.

For instance:
seba@asterix:~$ dig google.com MX
;; QUESTION SECTION:
;google.com. IN MX

;; ANSWER SECTION:
google.com. 900 IN MX 10 smtp1.google.com.
google.com. 900 IN MX 10 smtp2.google.com.
google.com. 900 IN MX 10 smtp3.google.com.
google.com. 900 IN MX 10 google.com.s9a1.psmtp.com.
google.com. 900 IN MX 100 google.com.s9a2.psmtp.com.

;; AUTHORITY SECTION:
google.com. 172800 IN NS ns4.google.com.
google.com. 172800 IN NS ns1.google.com.
google.com. 172800 IN NS ns2.google.com.
google.com. 172800 IN NS ns3.google.com.

;; ADDITIONAL SECTION:
smtp1.google.com. 3600 IN A 74.125.45.25
smtp2.google.com. 3600 IN A 74.125.65.25
smtp3.google.com. 3600 IN A 209.85.137.25

This tells us that if you
seba@asterix:~$ telnet smtp1.google.com. 25
Trying 74.125.45.25...
Connected to smtp1.google.com.
Escape character is '^]'.
help220 smtp.google.com ESMTP

214-2.0.0 This is sendmail version 8.13.8
214-2.0.0 Topics:
214-2.0.0 HELO EHLO MAIL RCPT DATA
214-2.0.0 RSET NOOP QUIT HELP VRFY
214-2.0.0 EXPN VERB ETRN DSN AUTH
214-2.0.0 STARTTLS
214-2.0.0 For more info use "HELP <topic>".
214-2.0.0 To report bugs in the implementation see
214-2.0.0 Contact Us - Support - sendmail.org
214-2.0.0 For local information send email to Postmaster at your site.
214 2.0.0 End of HELP info
help

So, the server is able to communicate with the domain.tld MX

email address) it does not give any results. However the internet browser is able to open the website of jimbob.com, and outlook is able to successfully send to hick@jimbob.com.

If you can connect to the destination MX, then you would like to check the logs. A lot of wisedom is hidden there :slight_smile:

Regards
Sebastian

If you have a smarthost defined, the email will be sent to your smarthost then on to the destination. If you are sending directly to the other host there are ways to debug it. First, do a lookup to find the MX (Mail eXchange) record for the domain.

dig -t mx jimbob.com.

Once you find out who the mail exchanger is, you could try to telnet to port 25 of that host which is the SMTP port and see if it responds.

You should also be able to look at the sendmail logs '/var/log/maillog' to see what is going on with the jimbob.com emails. See if they were sent on or if they are still sitting on your host waiting to be delivered.

I did have an instance a while back where a business changed ISPs. Any customer using the old ISP, still was getting the old MX record back instead of the current one. This is because the ISP did not delete the old MX record once the domain left their control.

You may also have a routing problem where you just can't get to the destination SMTP server. You may also have a case where the destination server is using anti-spam protection and your server or the range of IP addresses it uses were defined as SPAM senders and the destination server is not accepting a connection from you.

You might also try traceroute to the destination SMTP server to see if that works.

This doesn't test TCP port 25 on the mail server. Ping is not the right command.

This does:

dig mx jimbob.com

Now get IP address shown.

telnet <IP address> 25

It doesn't appear there is any log file for sendmail, I have checked the sendmail.cf and it doesn't appear there either. I'm wondering if I can possibly produce a log file on the fly which does the same thing?

I noticed the flag -X in the man pages:
-X LogFile Logs all traffic in and out of sendmail in LogFile for debugging
mailer problems. Use this flag sparingly, since it produces a lot of data very
quickly. This flag applies only to 4.2 or later.However I'm not sure how to use it, when I try excuting:
$ sendmail -X blah.dat
Cannot chdir(/var/spool/mqueue): The file access permissions do not allow the specified action.Not sure if there is anything better available either.

I followed your steps, but it hanged:Trying...
telnet: connect: A remote host did not respond within the timeout period.
What I did.... I obtained the MX record and used the mail server it listed. Tested for not just jimbob.com, but also gmail.com, hotmail.com and yahoo.com - they all hanged. So I'm guessing it is a security restriction blocking the telnet session for external sites.

---------- Post updated at 05:27 PM ---------- Previous update was at 06:23 AM ----------

Apologies for bringing this back into light, but has anyone else got any more ideas? Kinda struggling to find a resolution to this one.

I will get the mail log working tomorrow, but there doesn't seem an awful lot of information going into it.

Unfortunately I can't test the connection by telneting to the mail server (as stated above), must be getting blocked when attempting to telnet into the external site.

Helpful replies so far though, but need moooOOORRRE! :slight_smile:

This should be answered by the network admin.
As a way to test, try other tcp services befor yelling the netadmin.
For instance, 21 - ftp, 22 - ssh, 80 - http, etc

telnet someotherhostyouknowisrunningssh 22
and see if it connects.
On most networks tcp/25 si denied because of the windows worms. Usually there is a so called "smart host" that receives the email from the network, and forwars it to the final destination. Get this information from the netadmin, too. If that is the case you will need a some special sendmail config.

---------- Post updated at 05:27 PM ---------- Previous update was at 06:23 AM ----------

If it is not, it should be. Set it up.

Some ISPs also block port 25 traffic, only allowing smtp traffic to be relayed to their own mail servers. Its suppose to help cut down on spam. Most times you have the ISP add an exception for you, or change your smart host setting in sendmail to point to your ISP's mail server.