In Progress CPANEL-42511 - email exim defer ( R=virtual_user T=dovecot_virtual_delivery defer (-1))

[ilyasjaelani]

Dear All,

i am facing problem with e-mail, incoming e-mail is frozen with logs like this:


2023-03-06 13:20:38 1pZ4D5-000VWw-2c rewrite: malformed address: '> may not follow "'[email protected]'"
2023-03-06 13:20:38 1pZ4D5-000VWw-2c failed to read delivery status for [email protected] from delivery subprocess
2023-03-06 13:20:38 1pZ4D5-000VWw-2c lmtp transport process returned non-zero status 0x0100: exit code 1
2023-03-06 13:20:38 1pZ4D5-000VWw-2c == [email protected] R=virtual_user T=dovecot_virtual_delivery defer (-1)
2023-03-06 13:20:38 1pZ4D5-000VWw-2c Frozen
2023-03-06 13:54:40 1pZ4D5-000VWw-2c Message is frozen


what do I have to do?

 

[cPRex]

Hey there! What do you see if you run this command on the system?

exigrep 1pZ4D5-000VWw-2c /var/log/exim_mainlog

Does that happen to be high load on the system at this time?

 

[ilyasjaelani]

Hi,

here is the full log of another email with the same case.

 

[phil99]

We have seen a few cases like this recently. I cannot be sure, but I think they started after the upgrade to WHM 108 with exim v4.96.

As the log entry in the original post shows, there is a malformed email address in the headers, or at least one that exim considers malformed. Similar to that email, we have seen addressess like:

"'[email protected]'" <[email protected]>

The single quotation marks inside the double quotation marks are what exim doesn't like and causes the error message, such as

rewrite: malformed address: '> may not follow "'[email protected]'"

There have possibly been other reasons for exim considering addresses malformed, but I have not studied these yet. The log entries in the second post do not appear to have been caused by single quotation marks.

It appears as though exim's parsing of addresses may have changed at some point. Whether this is a bug or correct behavior I don't know.

 

[cristianm]

I have the same issue that start with the last upgrade...

 

[R4 Datacenter]

I have four servers.
Three of them are running cPanel/WHM 108.0.14. In these servers I have the same issue.
One of them is running cPanel/WHM 106.0.18. In this server I don't see the error message ( rewrite: malformed address: ) .

I noticed that this happens only to our customes using 3rd party softwares ( like ERP's ). When sending messages from webmail and standard mail softwares, like Microsoft Outlook ou Mozila Thunderbird, the e-mail account is working perfectly.

 

[cPRex]

The closest thing I can find is this:

Bug 2903 – Rewrite rules in 4.96 cause SMTP connections to drop

bugs.exim.org

although it's not quite the same issue. Could one of you open a ticket with our team so we can do some more homework on this?

 

[phil99]

Hi, I have created ticket #94632079.

 

[ilyasjaelani]

Hi,

I have also created a ticket and the cpanel team has provided suggestions below:

We do have an internal case on the issue with case ID CPANEL-42511. While I do not have an ETA of resolution on the case, I encourage you to follow this support article in order to receive updates on it:

In v108, Exim's "EXPERIMENTAL: Rewrite From: header to match actual sender" fails when the "TO" header is separated with a semicolon


Section 3.6.3 of RFC5322 does not appear to be widely enforced, and was not enforced by cPanel's implementation of Exim previously.

Current workaround are:

• Update mailing scripts and email clients to separate recipient addresses with commas instead of semi-colons.
• Disable WHM -> Exim Configuration Manager -> "EXPERIMENTAL: Rewrite From: header to match actual sender.

 

[phil99]

Thanks ilyasjaelani. We have disabled the "EXPERIMENTAL: Rewrite" setting for now. The default is "disable", but it was set to "all", though we don't remember explicitly enabling it.

 

[cPRex]

I'm glad we could get a case open with our developers about this issue. I'm following along with this now and I'll be sure to share any updates I hear.

 

[R4 Datacenter]

Thank you ilyasjaelani. Just to let you know, we've disabled "EXPERIMENTAL: Rewrite From: header to match actual sender" as you suggested and the message "rewrite: malformed address:" is not occurring anymore.

 

[hostingmundial]

Hello,

We have the same issue and it started happening since cpanel upgrade to v108.
We had to disable "EXPERIMENTAL: Rewrite From" even though it was very useful in the past, but now it's causing occasionally delivery problems from legitimate emails.

Is there an internal case working on ways to fix this?

 

[cPRex]

@hostingmundial - the case number is in the title of this thread.

 

[bellwood]

@cPRex, could we have an update here?

Also, please note that the case link shared by @ilyasjaelani is not public.

 

[cPRex]

I've poked the team again to let them know there is still interest in this, but I don't see any updates on my end.

We do require users to sign in to view articles linked to cases. That way they can stay up-to-date if they choose to follow along.

 

[hostingmundial]

Hello,

Is this really "In Progress" ?

This feature was useful to unmask phishing.
We're still waiting for a fix to enable it again.

Thank you

 

[cPRex]

@hostingmundial - "In Progress" means there's a case open with our development team that I'm monitoring. As of right now, I don't have any updates to share.