Loading ...
Sorry, an error occurred while loading the content.
 

Re: Duplicate Emails Sent

Expand Messages
  • Ed
    Hi Victor, I have requested the info from site1. I looked for the SMTP RCPT TO command in the man file. Could you provide a hint as to the configuration
    Message 1 of 12 , Mar 19, 2013
      Hi Victor,

      I have requested the info from site1.

      I looked for the SMTP RCPT TO command in the man file.

      Could you provide a hint as to the configuration parameter?

      Ed



      From: Victor d'Agostino <d.agostino.victor@...>
      To: postfix-users@...
      Sent: Monday, March 18, 2013 5:45 PM
      Subject: Re: Duplicate Emails Sent

      Hi Ed,

      It seems that site3.com smtp server use header recipients instead of SMTP RCPT TO recipients and also send to the sender ...

      Can you post email headers to check the Received From fields ?


      Le 18/03/2013 21:51, Ed a écrit :
      Hi All.

      The scenario:

      From: aaaa@...
      To:      bbbb@...
      CC:     me@...

      After receiving the email CC at site 3, site 3 is sending out emails to everyone on the original,
      basically a duplicate email arrives to the sender and everyone in the headers.

      >>a sends mail to b with me in cc.
      >>me sends mail to everyone in the email headers

      I am asking how to stop this behavior.?

      I tried in an earlier attempt to post my postconf contents here but was rejected due to size.

      Thanks

      Ed



    • Larry Stone
      We generally do not top post on this list. Please keep replies in-line. ... From your initial description, it appears the problem is with site3. Site1
      Message 2 of 12 , Mar 19, 2013
        We generally do not top post on this list. Please keep replies in-line.

        On Mar 19, 2013, at 6:17 AM, Ed <ej197us@...> wrote:

        > I have requested the info from site1.
        >

        From your initial description, it appears the problem is with site3. Site1 information will probably not be helpful.

        > I looked for the SMTP RCPT TO command in the man file.
        >
        > Could you provide a hint as to the configuration parameter?

        Sounds like you need to learn about how SMTP works. RCPT TO is one of the commands used between an SMTP client and an SMTP server. The address listed after RCPT TO is what is called the "envelope recipient" and is the destination address to which the server will deliver or forward the mail. The "To" and "CC" headers in a mail message are just part of the message to a mail server (think of it like snail mail - the post office delivers the mail to the recipient on the envelope and does not care at all to whom the letter inside the envelope says it is addressed).

        Your initial description makes it sound like something at site3 is parsing the message headers (From, To, and CC) and then attempting to resend the message to those addresses. If true, that is very wrong behavior on the part of site3. Your example says "me@..." so I assume you are the site3 recipient. Are you running some sort of script on the received message that might be doing this? Do you control the site3 SMTP server or are you just a user there?

        --
        Larry Stone
        lstone19@...
        http://www.stonejongleux.com/

        >
        > From: Victor d'Agostino <d.agostino.victor@...>
        > To: postfix-users@...
        > Sent: Monday, March 18, 2013 5:45 PM
        > Subject: Re: Duplicate Emails Sent
        >
        > Hi Ed,
        >
        > It seems that site3.com smtp server use header recipients instead of SMTP RCPT TO recipients and also send to the sender ...
        >
        > Can you post email headers to check the Received From fields ?
        >
        >
        > Le 18/03/2013 21:51, Ed a écrit :
        >> Hi All.
        >>
        >> The scenario:
        >>
        >> From: aaaa@...
        >> To: bbbb@...
        >> CC: me@...
        >>
        >> After receiving the email CC at site 3, site 3 is sending out emails to everyone on the original,
        >> basically a duplicate email arrives to the sender and everyone in the headers.
        >>
        >> >>a sends mail to b with me in cc.
        >> >>me sends mail to everyone in the email headers
        >>
        >> I am asking how to stop this behavior.?
        >>
        >> I tried in an earlier attempt to post my postconf contents here but was rejected due to size.
        >>
        >> Thanks
        >>
        >> Ed
        >
        >
        >
      • Ed
        Hi Larry, ... Hi Larry, From: Larry Stone To: postfix-users@postfix.org Users Sent: Tuesday, March
        Message 3 of 12 , Mar 19, 2013
          Hi Larry,



          From: Larry Stone <lstone19@...>
          To: "postfix-users@... Users" <postfix-users@...>
          Sent: Tuesday, March 19, 2013 7:46 AM
          Subject: Re: Duplicate Emails Sent

          We generally do not top post on this list. Please keep replies in-line.

          Ok...


          On Mar 19, 2013, at 6:17 AM, Ed <ej197us@...> wrote:

          > I have requested the info from site1.
          >

          From your initial description, it appears the problem is with site3. Site1 information will probably not be helpful.

          > I looked for the SMTP RCPT TO command in the man file.
          >
          > Could you provide a hint as to the configuration parameter?

          Sounds like you need to learn about how SMTP works. RCPT TO is one of the commands used between an SMTP client and an SMTP server. The address listed after RCPT TO is what is called the "envelope recipient" and is the destination address to which the server will deliver or forward the mail. The "To" and "CC" headers in a mail message are just part of the message to a mail server (think of it like snail mail - the post office delivers the mail to the recipient on the envelope and does not care at all to whom the letter inside the envelope says it is addressed).

          Yes, your correct.  I do need to learn.

          Your initial description makes it sound like something at site3 is parsing the message headers (From, To, and CC) and then attempting to resend the message to those addresses. If true, that is very wrong behavior on the part of site3. Your example says "me@..." so I assume you are the site3 recipient. Are you running some sort of script on the received message that might be doing this? Do you control the site3 SMTP server or are you just a user there?

          I have control over the site3 SMTP where the problem is. It is recent installation, late last year.  Is there a rule in postfix that i missed perhaps?


          --
          Larry Stone
          lstone19@...
          http://www.stonejongleux.com/

          >
          > From: Victor d'Agostino <d.agostino.victor@...>
          > To: postfix-users@...
          > Sent: Monday, March 18, 2013 5:45 PM
          > Subject: Re: Duplicate Emails Sent
          >
          > Hi Ed,
          >
          > It seems that site3.com smtp server use header recipients instead of SMTP RCPT TO recipients and also send to the sender ...
          >
          > Can you post email headers to check the Received From fields ?
          >
          >
          > Le 18/03/2013 21:51, Ed a écrit :
          >> Hi All.
          >>
          >> The scenario:
          >>
          >> From: aaaa@...
          >> To:      bbbb@...
          >> CC:    me@...
          >>
          >> After receiving the email CC at site 3, site 3 is sending out emails to everyone on the original,
          >> basically a duplicate email arrives to the sender and everyone in the headers.
          >>
          >> >>a sends mail to b with me in cc.
          >> >>me sends mail to everyone in the email headers
          >>
          >> I am asking how to stop this behavior.?
          >>
          >> I tried in an earlier attempt to post my postconf contents here but was rejected due to size.
          >>
          >> Thanks
          >>
          >> Ed
          >
          >
          >






        • Larry Stone
          ... Then please follow the directions you received when you joined the list and include the postconf -n output from site3 as well as a log snippet showing
          Message 4 of 12 , Mar 19, 2013
            On Tue, 19 Mar 2013, Ed wrote:

            > I have control over the site3 SMTP where the problem is. It is recent
            > installation, late last year.  Is there a rule in postfix that i
            > missed perhaps?

            Then please follow the directions you received when you joined the list
            and include the "postconf -n" output from site3 as well as a log snippet
            showing the problem. Include both the initial receipt of the message from
            site1 and the sending of the message back out to the sender and all
            the recipients. At this point, you should probably also restate your
            problem since many people do not save every message and would not have
            your initial statement of the problem.

            -- Larry Stone
            lstone19@...
          • Ed
            Hi All. I am experiencing an issue with the following: The scenario:   From: aaaa@site1.com To:      bbbb@site2.com CC:    me@site3.com   After
            Message 5 of 12 , Mar 19, 2013
              Hi All.

              I am experiencing an issue with the following:

              The scenario:
               
              From: aaaa@...
              To:      bbbb@...
              CC:    me@...
               
              After receiving the email CC at site 3, site 3 is sending out emails to everyone on the original,
              basically a duplicate email arrives to the sender and everyone in the headers.

              >>a sends mail to b with me in cc.
              >>me@... sends mail out to everyone in the FROM and CC upon receipt of the mail


              I am asking how to stop this behavior.?


              Site 3 logs and postconf follows
              Logs
              ----------------------
              Mar 14 10:27:41 mail postfix/cleanup[5265]: 10E7BE1C0A: message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...>
              Mar 14 10:27:41 mail postfix/smtpd[5269]: disconnect from localhost[127.0.0.1]
              Mar 14 10:27:41 mail postfix/smtp[5266]: 44D90E014D: to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.5, delays=1.7/0.02/0/4.7, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=03066-15, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 10E7BE1C0A)
              Mar 14 10:27:41 mail postfix/qmgr[2179]: 44D90E014D: removed
              Mar 14 10:27:41 mail postfix/smtp[5270]: 10E7BE1C0A: to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.05, delays=0.03/0.02/0/0, dsn=2.0.0, status=sent (250 Ok)
              Mar 14 10:27:41 mail postfix/qmgr[2179]: 10E7BE1C0A: removed
              Mar 14 10:27:41 mail postfix/smtpd[5272]: connect from localhost[127.0.0.1]
              Mar 14 10:27:41 mail postfix/smtpd[5272]: 4B9A3E1C0A: client=localhost[127.0.0.1]
              Mar 14 10:27:41 mail postfix/cleanup[5265]: 4B9A3E1C0A: message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...>
              Mar 14 10:27:41 mail postfix/qmgr[2179]: 4B9A3E1C0A: from=<avery.robert@...>, size=7049, nrcpt=3 (queue active)
              Mar 14 10:27:41 mail postfix/smtpd[5272]: disconnect from localhost[127.0.0.1]
              Mar 14 10:27:41 mail lmtpunix[5164]: accepted connection
              Mar 14 10:27:41 mail lmtpunix[5164]: lmtp connection preauth'd as postman
              Mar 14 10:27:41 mail master[5276]: about to exec /usr/lib/cyrus-imapd/lmtpd
              Mar 14 10:27:41 mail lmtpunix[5276]: executed
              Mar 14 10:27:41 mail lmtpunix[5164]: ptload(): fetched cache record (edlang@...)(mark 1363263746, current 1363271261, limit 1363260461)
              Mar 14 10:27:41 mail lmtpunix[5164]: ptload returning data
              Mar 14 10:27:41 mail lmtpunix[5164]: using ptloaded value of: edlang@...
              Mar 14 10:27:41 mail lmtpunix[5164]: ptload(): fetched cache record (edlang@...)(mark 1363263746, current 1363271261, limit 1363260461)
              Mar 14 10:27:41 mail lmtpunix[5164]: ptload returning data
              Mar 14 10:27:41 mail lmtpunix[5164]: using ptloaded value of: edlang@...
              Mar 14 10:27:41 mail lmtpunix[5164]: Delivered: <E72852EF80963148B21E9046E0C9BDC82863FEC1@...> to mailbox: cybered-corp.com!user.edlang
              Mar 14 10:27:41 mail lmtpunix[5164]: USAGE edlang user: 0.011998 sys: 0.016997
              Mar 14 10:27:41 mail postfix/lmtp[5273]: 4B9A3E1C0A: to=<edlang@...>, relay=mail.avnoc.com[/var/lib/imap/socket/lmtp], delay=0.15, delays=0.04/0.03/0/0.08, dsn=2.1.5, status=sent (250 2.1.5 Ok SESSIONID=<mail.avnoc.com-5164-1363271261-1>)

              Here is where it looks like upon receipt of the original email we are sending mail back out

              Mar 14 10:27:41 mail postfix/smtp[5274]: 4B9A3E1C0A: enabling PIX workarounds: disable_esmtp delay_dotcrlf for spamtrap1a.nps.k12.va.us[216.54.48.8]:25
              Mar 14 10:27:41 mail postfix/smtp[5275]: 4B9A3E1C0A: to=<crawford.chris@...>, relay=mail.secep.net[216.54.45.133]:25, delay=0.42, delays=0.04/0.06/0.1/0.23, dsn=2.0.0, status=sent (250 Ok: queued as AD9CA2B8C073)
              Mar 14 10:27:43 mail postfix/smtp[5274]: 4B9A3E1C0A: to=<rdavis@...>, relay=spamtrap1a.nps.k12.va.us[216.54.48.8]:25, delay=2, delays=0.04/0.03/0.23/1.7, dsn=2.0.0, status=sent (250 2.0.0 r2EERf48009708 Message accepted for delivery)
              Mar 14 10:27:43 mail postfix/qmgr[2179]: 4B9A3E1C0A: removed

              PostConf Output
              ----------------------------
              alias_database = hash:/etc/aliases
              alias_maps = hash:/etc/aliases
              command_directory = /usr/sbin
              config_directory = /etc/postfix
              content_filter = smtp-amavis:[127.0.0.1]:10024
              daemon_directory = /usr/libexec/postfix
              data_directory = /var/lib/postfix
              debug_peer_level = 2
              html_directory = no
              inet_interfaces = all
              inet_protocols = all
              local_recipient_maps = ldap:/etc/postfix/ldap/local_recipient_maps.cf
              mailq_path = /usr/bin/mailq.postfix
              manpage_directory = /usr/share/man
              mydestination = ldap:/etc/postfix/ldap/mydestination.cf
              mynetworks = 127.0.0.0/8, 10.0.0.0/8
              mynetworks_style = host
              myorigin = $mydomain
              newaliases_path = /usr/bin/newaliases.postfix
              readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
              sample_directory = /usr/share/doc/postfix-2.6.6/samples
              sendmail_path = /usr/sbin/sendmail.postfix
              setgid_group = postdrop
              smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_rbl_client zen.spamhaus.org, reject_non_fqdn_recipient, reject_invalid_helo_hostname, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service unix:private/recipient_policy_incoming, permit
              smtpd_sender_restrictions = permit_mynetworks, check_policy_service unix:private/sender_policy_incoming
              smtpd_tls_auth_only = yes
              smtpd_tls_cert_file = /etc/pki/tls/private/localhost.pem
              smtpd_tls_key_file = /etc/pki/tls/private/localhost.pem
              transport_maps = ldap:/etc/postfix/ldap/transport_maps.cf
              unknown_local_recipient_reject_code = 550
              virtual_alias_maps = $alias_maps, ldap:/etc/postfix/ldap/virtual_alias_maps.cf, ldap:/etc/postfix/ldap/mailenabled_distgroups.cf, ldap:/etc/postfix/ldap/mailenabled_dynamic_distgroups.cf, hash:/etc/postfix/virtual




              From: Larry Stone <lstone19@...>
              To: "postfix-users@... Users" <postfix-users@...>
              Sent: Tuesday, March 19, 2013 9:52 AM
              Subject: Re: Duplicate Emails Sent

              On Tue, 19 Mar 2013, Ed wrote:

              > I have control over the site3 SMTP where the problem is. It is recent
              > installation, late last year.  Is there a rule in postfix that i
              > missed perhaps?

              Then please follow the directions you received when you joined the list and include the "postconf -n" output from site3 as well as a log snippet showing the problem. Include both the initial receipt of the message from site1 and the sending of the message back out to the sender and all the recipients. At this point, you should probably also restate your problem since many people do not save every message and would not have your initial statement of the problem.

              -- Larry Stone
                lstone19@...

            • Noel Jones
              ... The are basically two ways mail can be resent to header addresses. Either you re sending to a content_filter that feeds the mail into sendmail -t (very
              Message 6 of 12 , Mar 19, 2013
                On 3/19/2013 10:50 AM, Ed wrote:
                > Hi All.
                >
                > I am experiencing an issue with the following:
                >
                > The scenario:
                >
                > From: aaaa@... <mailto:aaaa@...>
                > To: bbbb@... <mailto:bbbb@...>
                > CC: me@... <mailto:me@...>
                >
                > After receiving the email CC at site 3, site 3 is sending out emails
                > to everyone on the original,
                > basically a duplicate email arrives to the sender and everyone in
                > the headers.

                The are basically two ways mail can be resent to header addresses.
                Either you're sending to a content_filter that feeds the mail into
                "sendmail -t" (very bad! don't do that), or the recipient has a
                procmail or similar delivery filter that is resending the mail.


                It's not clear from the logs you've posted what is happening, but
                it's sure to be one of these.



                -- Noel Jones
              • Larry Stone
                ... You then include logs but it s hard to figure out what corresponds to site1, site2, and site3. The logs appear to indicate that there are one or more
                Message 7 of 12 , Mar 19, 2013
                  On Tue, 19 Mar 2013, Ed wrote:

                  > Hi All.
                  >
                  > I am experiencing an issue with the following:
                  >
                  > The scenario:
                  >  
                  > From: aaaa@...
                  > To:      bbbb@...
                  > CC:    me@...
                  >  
                  > After receiving the email CC at site 3, site 3 is sending out emails to
                  > everyone on the original,
                  > basically a duplicate email arrives to the sender and everyone in the
                  > headers.

                  You then include logs but it's hard to figure out what corresponds to
                  site1, site2, and site3.

                  The logs appear to indicate that there are one or more content filters at
                  play. Noel pointed out what can happen if they're poorly designed.

                  Postfix

                  > Site 3 logs and postconf follows
                  > Logs
                  > ----------------------
                  > Mar 14 10:27:41 mail postfix/cleanup[5265]: 10E7BE1C0A:message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...
                  > al>
                  > Mar 14 10:27:41 mail postfix/smtpd[5269]: disconnect from
                  > localhost[127.0.0.1]
                  > Mar 14 10:27:41 mail postfix/smtp[5266]: 44D90E014D:
                  > to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.5,
                  > delays=1.7/0.02/0/4.7, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=03066-15,
                  > from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 10E7BE1C0A)

                  What's this. We see the queue ID reported by the recieving SMTP server in
                  our own logs. Is this just being handed off to our same Postfix instance
                  on another port?

                  > Mar 14 10:27:41 mail postfix/qmgr[2179]: 44D90E014D: removed
                  > Mar 14 10:27:41 mail postfix/smtp[5270]: 10E7BE1C0A:
                  > to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.05,
                  > delays=0.03/0.02/0/0, dsn=2.0.0, status=sent (250 Ok)

                  Handed off to a content filter at port 10026.

                  > Mar 14 10:27:41 mail postfix/qmgr[2179]: 10E7BE1C0A: removed

                  > Mar 14 10:27:41 mail postfix/smtpd[5272]: connect from localhost[127.0.0.1]
                  > Mar 14 10:27:41 mail postfix/smtpd[5272]: 4B9A3E1C0A:
                  > client=localhost[127.0.0.1]
                  > Mar 14 10:27:41 mail postfix/cleanup[5265]: 4B9A3E1C0A:message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...
                  > al>
                  > Mar 14 10:27:41 mail postfix/qmgr[2179]: 4B9A3E1C0A:
                  > from=<avery.robert@...>, size=7049, nrcpt=3 (queue active)

                  And comes back from a content filter with 3 recipients.

                  Seeing your master.cf might help too. But it's most likely the content
                  filter listening to port 10026.

                  -- Larry Stone
                  lstone19@...
                • Ed
                  Thanks Noel, I am going to set up a defined test and look into sendmail/procmail thoughts Ed ... Thanks Noel, I am going to set up a defined test and look into
                  Message 8 of 12 , Mar 19, 2013
                    Thanks Noel,

                    I am going to set up a defined test and look into sendmail/procmail thoughts

                    Ed



                    From: Noel Jones <njones@...>
                    To: postfix-users@...
                    Sent: Tuesday, March 19, 2013 12:41 PM
                    Subject: Re: Duplicate Emails Sent RESTATED

                    On 3/19/2013 10:50 AM, Ed wrote:
                    > Hi All.
                    >
                    > I am experiencing an issue with the following:
                    >
                    > The scenario:

                    > From: aaaa@... <mailto:aaaa@...>
                    > To:      bbbb@... <mailto:bbbb@...>
                    > CC:    me@... <mailto:me@...>

                    > After receiving the email CC at site 3, site 3 is sending out emails
                    > to everyone on the original,
                    > basically a duplicate email arrives to the sender and everyone in
                    > the headers.

                    The are basically two ways mail can be resent to header addresses.
                    Either you're sending to a content_filter that feeds the mail into
                    "sendmail -t"  (very bad! don't do that), or the recipient has a
                    procmail or similar delivery filter that is resending the mail.


                    It's not clear from the logs you've posted what is happening, but
                    it's sure to be one of these.



                      -- Noel Jones


                  • Ed
                    Thanks for the insight  Larry. I think that some work nee3ds to be done on the filter at 100026 Ed ... Thanks for the insight Larry. I think that some work
                    Message 9 of 12 , Mar 20, 2013
                      Thanks for the insight  Larry.

                      I think that some work nee3ds to be done on the filter at 100026

                      Ed


                      From: Larry Stone <lstone19@...>
                      To: "postfix-users@... Users" <postfix-users@...>
                      Sent: Tuesday, March 19, 2013 1:10 PM
                      Subject: Re: Duplicate Emails Sent RESTATED

                      On Tue, 19 Mar 2013, Ed wrote:

                      > Hi All.
                      >
                      > I am experiencing an issue with the following:
                      >
                      > The scenario:
                      >  
                      > From: aaaa@...
                      > To:      bbbb@...
                      > CC:    me@...
                      >  
                      > After receiving the email CC at site 3, site 3 is sending out emails to
                      > everyone on the original,
                      > basically a duplicate email arrives to the sender and everyone in the
                      > headers.

                      You then include logs but it's hard to figure out what corresponds to site1, site2, and site3.

                      The logs appear to indicate that there are one or more content filters at play. Noel pointed out what can happen if they're poorly designed.

                      Postfix

                      > Site 3 logs and postconf follows
                      > Logs
                      > ----------------------
                      > Mar 14 10:27:41 mail postfix/cleanup[5265]: 10E7BE1C0A:message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...
                      > al>
                      > Mar 14 10:27:41 mail postfix/smtpd[5269]: disconnect from
                      > localhost[127.0.0.1]
                      > Mar 14 10:27:41 mail postfix/smtp[5266]: 44D90E014D:
                      > to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.5,
                      > delays=1.7/0.02/0/4.7, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=03066-15,
                      > from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 10E7BE1C0A)

                      What's this. We see the queue ID reported by the recieving SMTP server in our own logs. Is this just being handed off to our same Postfix instance on another port?

                      > Mar 14 10:27:41 mail postfix/qmgr[2179]: 44D90E014D: removed
                      > Mar 14 10:27:41 mail postfix/smtp[5270]: 10E7BE1C0A:
                      > to=<edlang@...>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.05,
                      > delays=0.03/0.02/0/0, dsn=2.0.0, status=sent (250 Ok)

                      Handed off to a content filter at port 10026.

                      > Mar 14 10:27:41 mail postfix/qmgr[2179]: 10E7BE1C0A: removed

                      > Mar 14 10:27:41 mail postfix/smtpd[5272]: connect from localhost[127.0.0.1]
                      > Mar 14 10:27:41 mail postfix/smtpd[5272]: 4B9A3E1C0A:
                      > client=localhost[127.0.0.1]
                      > Mar 14 10:27:41 mail postfix/cleanup[5265]: 4B9A3E1C0A:message-id=<E72852EF80963148B21E9046E0C9BDC82863FEC1@...
                      > al>
                      > Mar 14 10:27:41 mail postfix/qmgr[2179]: 4B9A3E1C0A:
                      > from=<avery.robert@...>, size=7049, nrcpt=3 (queue active)

                      And comes back from a content filter with 3 recipients.

                      Seeing your master.cf might help too. But it's most likely the content filter listening to port 10026.

                      -- Larry Stone
                        lstone19@...

                    Your message has been successfully submitted and would be delivered to recipients shortly.