Skip to main content

Dovecot sieve forwards a copy to non authorized email address [Resolved]

Recently, dovecot started to resend a copy of all emails received on a few accounts to a non authorized email address: puncheseurope23@gmaiil.com. Aparently the message is generated locally (127.0.0.1) but I cannot find out where or how it is being generated.

Mar 26 19:37:44 sd-4XXXX postfix/cleanup[21014]: 64BA6E182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:44 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: from=, size=15412, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: connect from localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: E1743E1839D6: client=localhost[127.0.0.1]
Mar 26 19:37:46 sd-4XXXX postfix/cleanup[21014]: E1743E1839D6: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:46 sd-4XXXX postfix/smtpd[21022]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: from=, size=16476, nrcpt=1 (queue active)
Mar 26 19:37:46 sd-4XXXX amavis[32748]: (32748-11) Passed CLEAN {RelayedInternal}, ORIGINATING LOCAL [8X.8X.6X.3X]:55254 [8X.8X.6X.3X]  -> , Queue-ID: 64BA6E182985, Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: Buvs90Q9JFpr, Hits: -2.898, size: 15412, queued_as: E1743E1839D6, dkim_new=default:mydomain.com, 2353 ms
Mar 26 19:37:46 sd-4XXXX postfix/smtp[21015]: 64BA6E182985: to=, relay=127.0.0.1[127.0.0.1]:10026, delay=2.6, delays=0.23/0.01/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10027): 250 2.0.0 Ok: queued as E1743E1839D6)
Mar 26 19:37:46 sd-4XXXX postfix/qmgr[26225]: 64BA6E182985: removed
Mar 26 19:37:47 sd-4XXXX postfix/pickup[831]: 0CA2BE1851F7: uid=5000 from=
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: forwarded to 
Mar 26 19:37:47 sd-4XXXX postfix/cleanup[21014]: 0CA2BE1851F7: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: from=, size=16711, nrcpt=1 (queue active)
Mar 26 19:37:47 sd-4XXXX dovecot: lda(info@destindomain.com): sieve: msgid=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>: stored mail into mailbox 'INBOX'
Mar 26 19:37:47 sd-4XXXX postfix/pipe[21023]: E1743E1839D6: to=, relay=dovecot, delay=0.27, delays=0.04/0.02/0/0.22, dsn=2.0.0, status=sent (delivered via dovecot service)
Mar 26 19:37:47 sd-4XXXX postfix/qmgr[26225]: E1743E1839D6: removed
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: connect from localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: 0113FE182985: client=localhost[127.0.0.1]
Mar 26 19:37:49 sd-4XXXX postfix/cleanup[21014]: 0113FE182985: message-id=<5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>
Mar 26 19:37:49 sd-4XXXX postfix/smtpd[21033]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0113FE182985: from=, size=17040, nrcpt=1 (queue active)
Mar 26 19:37:49 sd-4XXXX amavis[32627]: (32627-11) Passed CLEAN {RelayedOutbound}, LOCAL [127.0.0.1] [8X.8X.6X.3X]  -> , Message-ID: <5F95A212-FB12-4A6D-9ADF-DFFF63D70B98@mydomain.com>, mail_id: 4g8Irz6LJmCW, Hits: -3.098, size: 16711, queued_as: 0113FE182985, dkim_sd=default:mydomain.com, 1985 ms
Mar 26 19:37:49 sd-4XXXX postfix/smtp[21015]: 0CA2BE1851F7: to=, relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=0.12/0/0/2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 0113FE182985)
Mar 26 19:37:49 sd-4XXXX postfix/qmgr[26225]: 0CA2BE1851F7: removed

Edit 1 I have ISPConfig 3 installed in the server, and those email accounts had the non authorized address (puncheseurope23@gmaiil.com) in the cc field, I have removed those entries but the problem is still happening.

Edit 2 After some research I found out that dovecot sieve was configured to redirect those emails to the offending address. I checked the files in /var/vmail/destindomain.com/info/.sieve and I could find the line redirect "puncheseurope23@gmaiil.com", apparently created from ispconfig, but not removed when I modified the entry through the ispconfig interface.


Question Credit: spacebiker
Question Reference
Asked April 3, 2019
Posted Under: Network
92 views
Your Answer
D:\Adnan\Candoerz\CandoProject\vQA