Hi thanks for answer. No it does not correspond. I have no firewall in between, and what make it hard to troubleshoot is that sometime it works…
I try to catch logs from postfix and rspam on the same message:
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; task; rspamd_worker_body_handler: accepted connection from fd4d:6169:6c63:6f77::17 port 37628, task ptr: 00007F5938C0BDA0
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; task; rspamd_message_parse: loaded message; id: <20230831231234.5dc801a1@alezan.alezan.org>; queue-id: <3CAB540150A>; size: 326; checksum: <42e5ef00b82f76d86cf9ead026dc8d77>
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; greylist.lua:217: skip greylisting for local networks and/or authorized users
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; task; dkim_symbol_callback: skip DKIM checks for local networks and authorized users
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; spf.lua:186: skip SPF checks for local networks and authorized users
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; dmarc.lua:349: skip DMARC checks as either SPF or DKIM were not checked
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; lua_dkim_tools.lua:588: using selector prefix 'DKIM_SELECTORS' for domain 'alezan.org'
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; once_received.lua:102: Skipping once_received for authenticated user or local network
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; dkim_signing.lua:105: signing failure: cannot make request to load DKIM selector for domain alezan.org: nil
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; clamav.lua:131: clamav: message or mime_part is clean
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; greylist.lua:331: Score too low - skip greylisting
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; lua; neural.lua:442: skip ham sample to keep spam/ham balance; probability 0.729064039408867; 55 spam and 202 ham vectors stored
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; task; rspamd_task_write_log: id: <20230831231234.5dc801a1@alezan.alezan.org>, qid: <3CAB540150A>, ip: 82.65.243.228, user: mike@alezan.org, from: <mike@alezan.org>, (default: F (no action): [-6169.87/15.00] [GLOBAL_SMTP_FROM_WL(-4100.00){mike@alezan.org;alezan.org;},GLOBAL_MIME_FROM_WL(-2050.00){mike@alezan.org;},MAILCOW_AUTH(-20.00){},BAYES_SPAM(0.22){68.71%;},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},ASN(0.00){asn:12322, ipnet:82.64.0.0/14, country:FR;},BCC(0.00){},DBL_BLOCKED_OPENRESOLVER(0.00){alezan.alezan.org:helo;},DYN_RL_CHECK(0.00){},FREEMAIL_ENVRCPT(0.00){gmail.com;},FREEMAIL_TO(0.00){gmail.com;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},MID_RHS_MATCH_FROMTLD(0.00){},MIME_TRACE(0.00){0:+;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TAGGED_RCPT(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){},WHITELISTED_FWD_HOST(0.00){82.65.243.228;}]), len: 326, time: 445.381ms, dns req: 11, digest: <b3fa22c567703b89adcfbc2b06d10da6>, rcpts: <mickael.profeta@gmail.com,mickaelprofeta@gmail.com>, mime_rcpts: <mickael.profeta@gmail.com,>
mailcowdockerized-rspamd-mailcow-1 | 2023-08-31 23:12:35 #40(normal) <f33902>; task; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 1 regexps matched, 3388 regexps total, 3085 regexps cached, 0B scanned using pcre, 595B scanned total
the postfix log:
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:35 9c61d340b480 postfix/smtps/smtpd[69908]: 3CAB540150A: client=82-65-243-228.subs.proxad.net[82.65.243.228], sasl_method=LOGIN, sasl_username=mike@alezan.org
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:35 9c61d340b480 postfix/cleanup[69919]: 3CAB540150A: replace: header Received: from alezan.alezan.org (82-65-243-228.subs.proxad.net [82.65.243.228])??(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)?? key-exchange ECDHE (P-256) server-signature RSA-PSS from 82-65-243-228.subs.proxad.net[82.65.243.228]; from=<mike@alezan.org> to=<mickael.profeta@gmail.com> proto=ESMTP helo=<alezan.alezan.org>: Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 3CAB540150A??for <mickael.profeta@gmail.com>; Thu, 31 Aug 2023 23:12:35 +0200 (CEST)
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:35 9c61d340b480 postfix/cleanup[69919]: 3CAB540150A: message-id=<20230831231234.5dc801a1@alezan.alezan.org>
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:35 9c61d340b480 postfix/qmgr[383]: 3CAB540150A: from=<mike@alezan.org>, size=542, nrcpt=1 (queue active)
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:37 9c61d340b480 postfix/smtp[69920]: 3CAB540150A: to=<mickael.profeta@gmail.com>, relay=gmail-smtp-in.l.google.com[2a00:1450:400c:c00::1b]:25, delay=2, delays=0.78/0.03/0.43/0.77, dsn=5.7.28, status=bounced (host gmail-smtp-in.l.google.com[2a00:1450:400c:c00::1b] said: 550-5.7.28 [2001:41d0:1004:f5f:: 1] Our system has detected an unusual 550-5.7.28 rate of unsolicited mail originating from your IP address. To 550-5.7.28 protect our users from spam, mail sent from your IP address has been 550-5.7.28 blocked. Please visit 550-5.7.28 https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.28 Bulk Email Senders Guidelines. fo7-20020a05600c690700b003fe187e3441si1185049wmb.210 - gsmtp (in reply to end of DATA command))
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:37 9c61d340b480 postfix/bounce[69921]: 3CAB540150A: sender non-delivery notification: 2792E40155C
mailcowdockerized-postfix-mailcow-1 | Aug 31 23:12:37 9c61d340b480 postfix/qmgr[383]: 3CAB540150A: removed