Problem receiving mails from specific domain/users

MarcinN

Hi all,

I’m using mailcow for several years now and have a fantastic experience.

Recently my users have reported that they are missing some mails form a specific users on a specific domain.

When looking through postfix logs I have noticed a lot of 4.7.1 Service unavailable but with very little more details.

postfix-mailcow-1 | Nov 15 14:44:42 1c5b738c0235 postfix/cleanup[156298]: 79FE52009FE: milter-reject: END-OF-MESSAGE from s6c.cyber-folks.pl[185.208.164.6]: 4.7.1 Service unavailable - try again later; from=<mail@domain.info> to=<j.k@mm.pl> proto=ESMTP helo=<s6c.cyber-folks.pl> postfix-mailcow-1 | Nov 15 22:57:06 1c5b738c0235 postfix/cleanup[159715]: 996B82006BD: milter-reject: END-OF-MESSAGE from s6c.cyber-folks.pl[185.208.164.6]: 4.7.1 Service unavailable - try again later; from=<mail@domain.info> to=<j.k@mm.pl> proto=ESMTP helo=<s6c.cyber-folks.pl> postfix-mailcow-1 | Nov 16 07:12:09 1c5b738c0235 postfix/cleanup[162495]: 20C8E2006BD: milter-reject: END-OF-MESSAGE from s6c.cyber-folks.pl[185.208.164.6]: 4.7.1 Service unavailable - try again later; from=<mail@domain.info> to=<j.k@mm.pl> proto=ESMTP helo=<s6c.cyber-folks.pl> postfix-mailcow-1 | Nov 16 13:25:03 1c5b738c0235 postfix/cleanup[164567]: EE25B200A6C: milter-reject: END-OF-MESSAGE from s6c.cyber-folks.pl[185.208.164.6]: 4.7.1 Service unavailable - try again later; from=<mail@domain.info> to=<j.k@mm.pl> proto=ESMTP helo=<s6c.cyber-folks.pl> postfix-mailcow-1 | Nov 19 08:37:48 1c5b738c0235 postfix/cleanup[194201]: F05AC2024E7: replace: header Received: from 8d74eaa4408d (mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network [172.22.1.248])??(Authenticated sender: k.n@mm.com)??by mail.mm.com (Postcow) with ESM from mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.248]; from=<k.n@mm.pl> to=<mail@domain.info> proto=ESMTP helo=<8d74eaa4408d>: Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPA id F05AC2024E7;??Wed, 19 Nov 2025 08:37:48 +0100 (CET) postfix-mailcow-1 | Nov 19 08:37:53 1c5b738c0235 postfix/smtp[194204]: F05AC2024E7: to=<mail@domain.info>, relay=mail.domain.info[185.208.164.106]:25, delay=5, delays=0.75/0.05/0.22/4, dsn=2.0.0, status=sent (250 OK id=1vLclC-0000000EKo2-2yql) postfix-mailcow-1 | Nov 20 09:27:23 1c5b738c0235 postfix/cleanup[205123]: 8C24E2025CB: replace: header Received: from 8d74eaa4408d (mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network [172.22.1.248])??(Authenticated sender: k.n@mm.com)??by mail.mm.com (Postcow) with ESM from mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.248]; from=<k.n@mm.pl> to=<mail@domain.info> proto=ESMTP helo=<8d74eaa4408d>: Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPA id 8C24E2025CB;??Thu, 20 Nov 2025 09:27:23 +0100 (CET) postfix-mailcow-1 | Nov 20 09:27:25 1c5b738c0235 postfix/smtp[205124]: 8C24E2025CB: to=<mail@domain.info>, relay=mail.domain.info[185.208.164.106]:25, delay=2.2, delays=0.57/0.05/0.19/1.4, dsn=2.0.0, status=sent (250 OK id=1vM00i-000000066hA-2dlb) postfix-mailcow-1 | Nov 20 14:03:06 1c5b738c0235 postfix/smtp[208002]: 7DB10202554: to=<mail@domain.info>, relay=mail.domain.info[185.208.164.106]:25, delay=20, delays=2.1/0.01/0.3/17, dsn=2.0.0, status=sent (250 OK id=1vM4JG-0000000DwwE-1ExJ)

Details on a example failed mail
postfix-mailcow-1 | Nov 16 13:24:59 1c5b738c0235 postfix/smtpd[164566]: EE25B200A6C: client=s6c.cyber-folks.pl[185.208.164.6] postfix-mailcow-1 | Nov 16 13:25:00 1c5b738c0235 postfix/cleanup[164567]: EE25B200A6C: message-id=<809e0ebed6dd5aef8d7b8cc134f993ed@domain.info> postfix-mailcow-1 | Nov 16 13:25:03 1c5b738c0235 postfix/cleanup[164567]: EE25B200A6C: milter-reject: END-OF-MESSAGE from s6c.cyber-folks.pl[185.208.164.6]: 4.7.1 Service unavailable - try again later; from=<j.o@domain.info> to=<j.k@mm.pl> proto=ESMTP helo=<s6c.cyber-folks.pl>

Details of na example working email
docker compose logs postfix-mailcow | grep "5790B201543" postfix-mailcow-1 | Nov 20 15:02:29 1c5b738c0235 postfix/smtpd[208563]: 5790B201543: client=s6c.cyber-folks.pl[185.208.164.6] postfix-mailcow-1 | Nov 20 15:02:29 1c5b738c0235 postfix/cleanup[208564]: 5790B201543: message-id=<2cd2a4d95d51a71baf99d93fe7f6970a@zb.info> postfix-mailcow-1 | Nov 20 15:02:29 1c5b738c0235 postfix/qmgr[378]: 5790B201543: from=<d.c@zb.info>, size=3176, nrcpt=2 (queue active) postfix-mailcow-1 | Nov 20 15:02:30 1c5b738c0235 postfix/lmtp[208531]: 5790B201543: to=<k.n@mm.com>, orig_to=<k.n@mm.com>, relay=dovecot[172.22.1.250]:24, delay=0.67, delays=0.65/0.01/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <k.n@mm.com> 0AF+AHYfH2k5oi8AIO5+eg Saved) postfix-mailcow-1 | Nov 20 15:02:30 1c5b738c0235 postfix/lmtp[208532]: 5790B201543: to=<a.k@mm.com>, orig_to=<a.k@mm.com>, relay=dovecot[172.22.1.250]:24, delay=0.68, delays=0.65/0.01/0.01/0.02, dsn=2.0.0, status=sent (250 2.0.0 <a.k@mm.com> aPqIAHYfH2nLny8AIO5+eg Saved) postfix-mailcow-1 | Nov 20 15:02:30 1c5b738c0235 postfix/qmgr[378]: 5790B201543: removed

The sender domain is whitelisted, and if a mail works fine it is reported by Rspamd
When it fails no indication of an email in Rspamd can be found

I’m struggling to find any reasons on why

The sender domain has 2 users (j.o and d.c) and mails from one are delivered with no problems, and the second will have an error in same point in time.

How to get more details for such error or where to look next

DocFraggle

Your logs are from outgoing mails, as I can see.

Maybe check if your mailcow is listed on any blacklist

https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3Afqdn.of.your.mail.server&run=toolpage#

MarcinN

DocFraggle

No it is not. I would think that if it were then I would not receive emails at all, rather than receiving them and sending a 4.7.1
I would also have a lot of problems receiving emails from big vendors like google or MS, which work fine.

And when we mention MX toolbox (and other tools like this) I have not found a single tool that has problem sending test email to my domain.

Mailcow and the system is up to date

ETNyx

DocFraggle I believe you are wrong those logs seems to me as incoming e-mails,..

@MarcinN did you check all logs from this time? Not just Postfix? Specifically search for lines looking like those:

warning: connect to Milter service inet:rspamd:9900: Connection refused
warning: milter inet:rspamd:9900: error writing command: Broken pipe
warning: milter inet:rspamd:9900: can't read SMFIC_EOB reply packet header: Connection timed out

milter is the base keyword for looking.

MarcinN

ETNyx
Yes, those are incoming email problems (and logs), sorry if that was not obvious

And yes this is a ** milter-reject: END-OF-MESSAGE from**
Still this is in the postfix log.

Yey… when I finally realized that each log is using it’s own Time zone I finally found some details
(had to subtract 1h when searching to see 1h ahead in logs, not confusing at all
docker compose logs –since “2025-11-21T15:39:50” –until “2025-11-21T15:40:00”)

and there is NO queue ID on the error……

Nov 21 16:39:58 postfix/cleanup[221481]: warning: milter inet:rspamd:9900: can’t read SMFIC_BODYEOB reply packet header: Application error

So IT IS rspamd to blame (despite the whitelist). Now I have to find out why…

ETNyx

MarcinN Nov 21 16:39:58 postfix/cleanup[221481]: warning: milter inet:rspamd:9900: can’t read SMFIC_BODYEOB reply packet header: Application error

Saw this before,… try to double max_message in data/conf/rspamd/local.d/options.inc

Something in rspamd log? Also about whitelist, you use one in UI? This one is evaluated in rspamd, so this does not remove it from the equation.

MarcinN

So still this
https://docs.mailcow.email/manual-guides/Postfix/u_e-postfix-attachment_size/

weird as those messages should not be that large
Will try.

As for the log, had to look in the log directly, as there was no output on the all logs

rspamd-mailcow-1 | 2025-11-21 16:39:58 #37(rspamd_proxy) <643194>; proxy; proxy_backend_master_error_handler: cannot connect to upstream, maximum retries has been reached: 5