New Server Setup, email to [email protected] undeliverable

[mattcaz]

I setup a new cpanel VPS and have it all running great with email delivery, web etc and activated/configured csf. The only issue I can't seem to solve is this error message. I do have the domain server.domain.com in the localdomains file and I've searched everywhere for a solution and nothing seems to work.
I appreciate your time and any assistance, guidance you can provide.
--------------
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
root cannot accept local mail deliveries
Reporting-MTA: dns; server.cazserver.com

Action: failed
Final-Recipient: rfc822;[email protected]
Status: 5.0.0

------------------
/etc/redhat-release:CentOS Linux release 7.7.1908 (Core)
/usr/local/cpanel/version:11.84.0.15
/var/cpanel/envtype:kvm
CPANEL=release


Thank you,
Caz

 

[cPanelLauren]

Hello,


This is occurring because root literally cannot accept deliveries, this is the intended behavior. You need to set up forwarding for emails sent to root. This can be done by going to WHM>>Server Contacts>>Edit System Mail Preferences - Forward mail for root to:

I'd suggest setting this to an email address that will be accessible by the primary admin of the server

 

[mattcaz]

Hello,


This is occurring because root literally cannot accept deliveries, this is the intended behavior. You need to set up forwarding for emails sent to root. This can be done by going to WHM>>Server Contacts>>Edit System Mail Preferences - Forward mail for root to:

I'd suggest setting this to an email address that will be accessible by the primary admin of the server

Thanks for your response.. I have already done that as far as I can see.. did it yesterday.. but it doesn't seem to make a difference.
---------
The system currently forwards mail for “root” to “[email protected]”.
Forward mail for “root” to:

To forward email to one or more users on the server, or email addresses, enter them in a comma-separated list.

 

[cPanelLauren]

How old is the message you're checking? What is shown for the address when you go to WHM>>Email>>Mail Troubleshooter -> add [email protected]

 

[mattcaz]

Last one was today at 1:14PM MST.

I have attached the results screenshot of the troubleshooter. To me it looks like it's setup but the emails still come thru.

I appreciate your time and assistance,
Caz

 

[cPanelLauren]

That looks to be set up properly, are the emails being bounced? Do you have access to the command line interface? If so can you identify the message ID of one of the messages? It might be easiest to proceed as follows:

• Go to WHM>>Email>>Mail Delivery Reports
  • Search for [email protected], exact match, recipient, today only
• When the results appear there will be several columns but two we care about for these purposes
  • Obtain the ID of one of the messages in the ID column (one that you're certain was sent AFTER you modified the forwarding address)
  • Click the magnifying glass on actions. A popup should appear and provide some information on the mail transaction which will be helpful.
• With the message ID on the CLI run the folllowing:

  exigrep MID /var/log/exim_mainlog

  (replacing MID with the actual message ID)
• Provide the output of the command and a screenshot of the Delivery Event Details once complete - please obfuscate any identifying information as well

 

[mattcaz]

That looks to be set up properly, are the emails being bounced? Do you have access to the command line interface? If so can you identify the message ID of one of the messages? It might be easiest to proceed as follows:

• Go to WHM>>Email>>Mail Delivery Reports
  • Search for [email protected], exact match, recipient, today only
• When the results appear there will be several columns but two we care about for these purposes
  • Obtain the ID of one of the messages in the ID column (one that you're certain was sent AFTER you modified the forwarding address)
  • Click the magnifying glass on actions. A popup should appear and provide some information on the mail transaction which will be helpful.
• With the message ID on the CLI run the folllowing:

  exigrep MID /var/log/exim_mainlog

  (replacing MID with the actual message ID)
• Provide the output of the command and a screenshot of the Delivery Event Details once complete - please obfuscate any identifying information as well

I'm still checking it but I did notice this.. it's saying delivered to [email protected] when I don't have an email setup for that. This first part was in an attachment on the returned email: excessive resource usage.. this just started after I upgraded the whm to the newest version.
This is what I see when I click on the mail icon to look at the message:
-------------
The system failed to locate the message with Message ID “1iZhHz-0006JC-G6”. The system may have deleted the message: The address “[email protected]” is not local to this server.
-------------ATTACHMENT TO THE MAIL DELIVERY FAILED NOTIFICATION------
Time: Mon Nov 25 13:00:21 2019 -0700
Account: mpcaz
Resource: Process Time
Exceeded: 22629 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/528/bin/perl
Command Line: spamd child
PID: 1848 (Parent PID:1445)
Killed: No
-----------------------POPUP WHEN I CLICK ON THE MAGNIFYING GLASS ICON--------------

Event:	success
Sender User:	root
Sender Domain:
From Address:	[email protected]
Sender:	root
Sent Time:	Nov 26, 2019, 1:18:13 PM
Sender Host:	localhost
Sender IP:	127.0.0.1
Authentication:	localuser
Spam Score:
Recipient:	[email protected]
Delivered To:	[email protected]
Delivery User:	matt
Delivery Domain:
Router:	virtual_user
Transport:	dovecot_virtual_delivery
Out Time:	Nov 26, 2019, 1:18:13 PM
ID:	1iZhHz-0006JC-G6
Delivery Host:	localhost
Delivery IP:	127.0.0.1
Size:	1.07 KB
Result:	Accepted

-------------------------RESULT FROM THE GREP---------- LOOKS LIKE IT MIGHT BE A SPAM BOUNCE?-------
[root@server ~]# exigrep 1iZhHz-0006JC-G6 /var/log/exim_mainlog
2019-11-26 13:18:23 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1iZhHz-0006JC-G6

2019-11-26 13:18:23 1iZhHz-0006JC-G6 <= [email protected] U=root P=local S=1097 T="lfd on server.domain.com: blocked 168.63.250.91 (SG/Singapore/-)" for root
2019-11-26 13:18:23 1iZhHz-0006JC-G6 => matt <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> Tr7cIo+I3V3GXgAAV2p9bw Saved"
2019-11-26 13:18:23 1iZhHz-0006JC-G6 Completed

[root@server ~]#
--------------------------------
Does this provide any insight or am I just wasting your time?

Caz

 

[cPanelLauren]

This transaction seems to indicate that the message was delivered successfully:

[root@server ~]# exigrep 1iZhHz-0006JC-G6 /var/log/exim_mainlog
2019-11-26 13:18:23 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1iZhHz-0006JC-G6

2019-11-26 13:18:23 1iZhHz-0006JC-G6 <= [email protected] U=root P=local S=1097 T="lfd on server.domain.com: blocked 168.63.250.91 (SG/Singapore/-)" for root
2019-11-26 13:18:23 1iZhHz-0006JC-G6 => matt <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> Tr7cIo+I3V3GXgAAV2p9bw Saved"
2019-11-26 13:18:23 1iZhHz-0006JC-G6 Completed

[root@server ~]#

Are you receiving this in your email account for [email protected]?

[email protected] wouldn't exist, is it possible that at some point you had that set on accident? It does kind of appear that the intial notice was a bounce. You're showing two separate items as well:

1iZhHz-0006JC-G6 - this is an LFD notification indicating that LFD blocked an IP - this email looks succesful.

The prior one, doesn't look like the search completed succesfully:

-------------
The system failed to locate the message with Message ID “1iZhHz-0006JC-G6”. The system may have deleted the message: The address “[email protected]” is not local to this server.
-------------ATTACHMENT TO THE MAIL DELIVERY FAILED NOTIFICATION------
Time: Mon Nov 25 13:00:21 2019 -0700
Account: mpcaz
Resource: Process Time
Exceeded: 22629 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/528/bin/perl
Command Line: spamd child
PID: 1848 (Parent PID:1445)
Killed: No

But it's an entirely different type of notification - Also sent from LFD but in this instance it's sent to the account mpcaz about a process that has been running too long.

I'm curious, what's set in the rest of the system email preferences? Whats the email address contact set for the mpcaz account? This can be found in cPanel>>Preferences>>Contact Information and at WHM>>Account Information>>List Accounts

Does this provide any insight or am I just wasting your time?

Never a waste of time.

 

[mattcaz]

This transaction seems to indicate that the message was delivered successfully:

[root@server ~]# exigrep 1iZhHz-0006JC-G6 /var/log/exim_mainlog
2019-11-26 13:18:23 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1iZhHz-0006JC-G6

2019-11-26 13:18:23 1iZhHz-0006JC-G6 <= [email protected] U=root P=local S=1097 T="lfd on server.domain.com: blocked 168.63.250.91 (SG/Singapore/-)" for root
2019-11-26 13:18:23 1iZhHz-0006JC-G6 => matt <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> Tr7cIo+I3V3GXgAAV2p9bw Saved"
2019-11-26 13:18:23 1iZhHz-0006JC-G6 Completed

[root@server ~]#

Are you receiving this in your email account for [email protected]?

[email protected] wouldn't exist, is it possible that at some point you had that set on accident? It does kind of appear that the intial notice was a bounce. You're showing two separate items as well:

1iZhHz-0006JC-G6 - this is an LFD notification indicating that LFD blocked an IP - this email looks succesful.

The prior one, doesn't look like the search completed succesfully:

-------------
The system failed to locate the message with Message ID “1iZhHz-0006JC-G6”. The system may have deleted the message: The address “[email protected]” is not local to this server.
-------------ATTACHMENT TO THE MAIL DELIVERY FAILED NOTIFICATION------
Time: Mon Nov 25 13:00:21 2019 -0700
Account: mpcaz
Resource: Process Time
Exceeded: 22629 > 1800 (seconds)
Executable: /usr/local/cpanel/3rdparty/perl/528/bin/perl
Command Line: spamd child
PID: 1848 (Parent PID:1445)
Killed: No

But it's an entirely different type of notification - Also sent from LFD but in this instance it's sent to the account mpcaz about a process that has been running too long.

I'm curious, what's set in the rest of the system email preferences? Whats the email address contact set for the mpcaz account? This can be found in cPanel>>Preferences>>Contact Information and at WHM>>Account Information>>List Accounts


Never a waste of time.

mpcaz has my same email set, [email protected], my default email.. Its wierd, these only started after I upgraded to 84.0.14 and then 84.0.15. I can live with these notifications so I thank you for all your time and assistance.. I'll just look for anything beyond what I've been getting.

Have a great day and thanks again

Caz