Problem: Mail is being forwarded to root

[DaFux]

I am running ISPConfig (latest stable version) with postfix (maildir is checked). Under Admin I have created one reseller, no clients no sites.

The single reseller has 3 clients and a long list of sites.

Now, this is what happens: For most of the sites (but not all of them) their mails get auto-forwarded to site#1. The original receipient gets no mail at all.

This is how the mail headers look like:

Return-Path: <webmaster@sender.com>
X-Original-To: info@client16.com
Delivered-To: web4_admin@client1.com
Received: from SendersHost (senders.host.com [senders.ip])
by client1.com (Postfix) with ESMTP id 15CDC1EECC72
for <info@client16.com>; Mon, 16 Feb 2009 11:26:20 +0100 (CET)
From: "sender.com" <webmaster@sender.com>
To: <info@client16.com>
Subject: test
Date: Mon, 16 Feb 2009 11:26:19 +0100
Message-ID: <001101c99021$01e894f0$05b9bed0$@com>
MIME-Version: 1.0
X-Security: message sanitized on MyServer
See http://www.impsec.org/email-tools/sanitizer-intro.html
for details. $Revision: 1.151 $Date: 2006-01-20 07:29:24-08
X-Security: The postmaster has not enabled quarantine of poisoned messages.
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0012_01C99029.63ACFCF0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcmQIQF/7FZ1aTN7Sjm612QjJyHcqw==
X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 0.94/8995/Mon Feb 16 04:40:05 2009

In this example, mail was sent to user@site16.tld but was actually delivered to web4_admin@site1.com. This is very weird, I cannot find any reason for this behaviour.

Btw: info@client16.com is defined in ISP User / User & Email. CatchAll-Email is checked, all the rest is default.

/var/log/mail.log contains:

Feb 16 11:26:19 MyServer postfix/smtpd[27523]: connect from senders.host.com[senders.ip]
Feb 16 11:26:20 MyServer postfix/smtpd[27523]: 15CDC1EECC72: client=senders.host.com[senders.ip], sasl_method=LOGIN, sasl_username=web5_admin
Feb 16 11:26:20 MyServer postfix/cleanup[27527]: 15CDC1EECC72: message-id=<001101c99021$01e894f0$05b9bed0$@com>
Feb 16 11:26:20 MyServer postfix/qmgr[21656]: 15CDC1EECC72: from=<webmaster@sender.com>, size=2670, nrcpt=1 (queue active)
Feb 16 11:26:20 MyServer postfix/pickup[27242]: 529101EECD0A: uid=10001 from=<web4_admin>
Feb 16 11:26:20 MyServer postfix/cleanup[27527]: 529101EECD0A: message-id=<20090216102620.529101EECD0A@client1.com>
Feb 16 11:26:20 MyServer postfix/qmgr[21656]: 529101EECD0A: from=<web4_admin@client1.com>, size=384, nrcpt=1 (queue active)
Feb 16 11:26:20 MyServer postfix/local[27545]: 529101EECD0A: to=<admispconfig@localhost.localdomain>, relay=local, delay=0.07, delays=0.03/0.01/0/0.02, dsn=2.0.0, status=sent (delivered to command: /usr/bi
n/procmail -f-)
Feb 16 11:26:20 MyServer postfix/qmgr[21656]: 529101EECD0A: removed
Feb 16 11:26:22 MyServer postfix/smtpd[27523]: disconnect from senders.host.com[senders.ip]
Feb 16 11:26:23 MyServer postfix/local[27528]: 15CDC1EECC72: to=<web4_admin@client1.com>, orig_to=<info@client16.com>, relay=local, delay=3.1, delays=0.24/0.01/0/2.8, dsn=2.0.0, status=sent (delivered
to command: /usr/bin/procmail -f-)
Feb 16 11:26:23 MyServer postfix/qmgr[21656]: 15CDC1EECC72: removed
Feb 16 11:26:51 MyServer courierpop3login: Connection, ip=[::ffff:senders.ip]

Usually the problem sits in front of the computer - but I can't find the mistake I made. Can anybody help?

Regards
DaFux

[till]

Take a look in your aliases file, some linux distributions put there default aliases that forward emails to root. Remove the lines that you dont need and run the newaliases command.

[DaFux]

Sorry for my late reply - didn't see there was a message...

I already checked that - aliases just contains the standards (and even them I removed for testing - no change).

Address reqwriting and masquerading is also off.

I have checked everything and ust can't find the problem.

[till]

is the domain of this site the same then the hostname of your server?

[DaFux]

No, domain and hostname are not the same. The hostname is a unique name which does not appear in my domain names...

[falko]

What's in /etc/postfix/main.cf, /etc/postfix/local-host-names, and /etc/postfix/virtusertable?

[DaFux]

/etc/postfix/main.cf

#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
# TLS parameters
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = <domain name of site #1>
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
#mydestination = <domain name of site #1>, <hostname>, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject _unauth_destination
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

virtual_maps = hash:/etc/postfix/virtusertable

mydestination = /etc/postfix/local-host-names


/etc/postfix/local-host-names

this is a very long file, containing all domains on the server. Sorry, but can't publish here without causing problems with privacy and my customers

in general, the file looks like

localhost
<hostname>
localhost.<hostname>
localhost.localdomain
<www.site1.tld>
<www.site2.tld>
etc.

/etc/postfix/virtusertable

same problem as above - privacy, can't post that...

anyway, I have checked and rechecked this file for possible problems myself many times and could not find any. All associations are correct and exactly what they should be.

Thanks
DaFux

[DaFux]

Update: In my original posting I said "for most of the sites (but not all of them) their mails get auto-forwarded to site#1". I just verified that - actually all mail for all sites is forwarded to site #1.

[falko]

Is this maybe the problem? http://www.howtoforge.com/faq/9_33_en.html

[DaFux]

Unfortunately not.

Actually the variable $mydomain does not exist at all in my main.cf. Instead I have $myhostname which is indeed set to the domain name of the user who receives all mail.

BUT: If I change that to another value and reload postfix, nothing changes. Still the same problem.

The header looks like:

X-Original-To: info@<recipient.com>
Delivered-To: web4_admin@<wrong_recipient.com>
Received: from ... (... [213.xxx.xxx.xxx])
	by <value in $myhostname> (Postfix) with SMTP id 75C2A1EECCE5

I tried almost everything for $myhostname, does not make any difference. Actually $myhostname is used for the server banner only, so it should not make much difference, it just appears in the mail header.

Cheers
DaFux