Why does mail from QQ get held instead of delivered?

[scientificCommunity]

hi, Can receive emails from gmail but not from qq.com , The email log from qq is as follows:

May  2 20:46:13 mail postfix/postscreen[3566]: CONNECT from [2001:db8:1::1]:48634 to [2001:d:1::242:ac1:]:25
May  2 20:46:13 mail postfix/postscreen[3566]: PASS OLD [2001:d8:1::1]:48634
May  2 20:46:13 mail postfix/smtpd[3388]: connect from unknown[2001:d8:1::1]
May  2 20:46:13 mail postfix/smtpd[3388]: Anonymous TLS connection established from unknown[2001:d8:1::1]: TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)
May  2 20:46:14 mail postfix/smtpd[3388]: 317E0B381537: client=unknown[2001:d8:1::1]
May  2 20:46:14 mail postfix/cleanup[3644]: 317E0B381537: message-id=<tencent_777791D7F16283BD224F54E73BCAC3F2B208@qq.com>
May  2 20:46:14 mail opendkim[533]: 317E0B381537: [2001:db8:1::1] [2001:d8:1::1] not internal
May  2 20:46:14 mail opendkim[533]: 317E0B381537: not authenticated
May  2 20:46:19 mail opendkim[533]: 317E0B381537: key retrieval failed (s=s201512, d=qq.com): 's201512._domainkey.qq.com' query timed out
May  2 20:46:19 mail opendmarc[542]: 317E0B381537: qq.com fail
May  2 20:46:19 mail postfix/cleanup[3644]: 317E0B381537: milter-hold: END-OF-MESSAGE from unknown[2001:d8:1::1]: milter triggers HOLD action; from=<xxx@qq.com> to=<support@xxx> proto=ESMTP helo=<xmbg7.mail.qq.com>
May  2 20:46:19 mail postfix/smtpd[3388]: disconnect from unknown[2001:d8:1::1] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

---

Based on the logs you provided, it appears that the issue with receiving emails from qq.com is related to DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) verification failures. Here are the key points from the logs:

1. DKIM Verification Failure: The log entry key retrieval failed (s=s201512, d=qq.com): 's201512._domainkey.qq.com' query timed out indicates that the DKIM key for qq.com could not be retrieved because the DNS query timed out. This failure means that the email could not be verified as legitimately coming from qq.com based on its DKIM signature.

2. DMARC Verification Failure: The log opendmarc[542]: 317E0B381537: qq.com fail suggests that the DMARC policy of qq.com could not be verified or the email failed DMARC checks.

3. Email Held: Due to these verification issues, the email was put on hold as indicated by milter-hold: END-OF-MESSAGE from unknown[2001:d8:1::1]: milter triggers HOLD action.

To address this issue, you can try the following steps:

• Check DNS Resolution: Ensure that your mail server can properly resolve DNS queries, especially for DKIM records. This might involve checking your DNS resolver settings or using different DNS servers to see if the issue persists.

• Review DKIM and DMARC Settings: Verify that your mail server is correctly configured to handle DKIM and DMARC verifications. This includes ensuring that any necessary public keys and policies are accessible and properly set up.

• Adjust Milter Settings: If emails from qq.com are regularly legitimate, you might consider adjusting your milter settings to handle cases where DKIM or DMARC verifications fail due to DNS timeouts more gracefully.

If the problem continues, further investigation into network or DNS configuration issues at your end might be necessary. Additionally, monitoring for repeated DNS query timeouts could help identify if the issue is with specific DNS queries or a broader network problem.

This comment was generated by Glime.

[polarathene]

May 2 20:46:13 mail postfix/postscreen[3566]: CONNECT from [2001:db8:1::1]:48634 to [2001:d:1::242:ac1:]:25

You're using IPv6, but this is a an IPv6 prefix intended for documentation. Have you manipulated this yourself for sharing, or are these unmodified logs? If unmodified, can you try disabling IPv6? Ensure that you're getting proper IPv4 connections, not those from the docker network gateway.

For more information please look over our IPv6 docs page, related in the "Examples" navigation tab is a guide for configuring "PROXY protocol" as well if you have a reverse proxy in the mix. Once you're getting the real client IP in your connection logs, then try again.

---

Other than that the AI response seems to be pretty spot on, your container is having trouble checking DNS for qq.com DKIM record, you should get something like this if it was working:

$ drill TXT s201512._domainkey.qq.com

;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 4231
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; s201512._domainkey.qq.com.   IN      TXT

;; ANSWER SECTION:
s201512._domainkey.qq.com.      1200    IN      TXT     "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPsFIOSteMStsN615gUWK2RpNJ/B/ekmm4jVlu2fNzXADFkjF8mCMgh0uYe8w46FVqxUS97habZq6P5jmCj/WvtPGZAX49jmdaB38hzZ5cUmwYZkdue6dM17sWocPZO8e7HVdq7bQwfGuUjVuMKfeTB3iNeo6/hFhb9TmUgnwjpQIDAQAB"

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 250 msec
;; SERVER: 192.168.65.7
;; WHEN: Thu May  2 23:15:34 2024
;; MSG SIZE  rcvd: 315

Due to the failure, the mail is held in the Postfix queue instead of delivered / rejected. You could also try using Rspamd instead of OpenDKIM/OpenDMARC, view our docs for information on how to configure for that.

---

Please do share the solution for others if you identify the cause, thanks!