How to track this email message?
Question asked by Merle Wait - 9/28/2026 at 11:36 AM
Answered
This message came into our inbound server.. and shows being sent to the main server
SMTP
[2026.09.24] 16:51:23.885 [67.227.228.139][21664732] Data transfer succeeded, writing mail to 75769285.eml (MessageID: <ab7c286efd66a363aa00797bfb28bc45@XXXXXXX.ZZZZZZ.com>)
[2026.09.24] 16:51:23.940 [67.227.228.139][21664732] cmd: QUIT
[2026.09.24] 16:51:23.940 [67.227.228.139][21664732] rsp: 221 OK
inbound.server.com --> main.mailserver.com

Soooo it was moved to the main server
On the main mail server... that message ID is no where to be found.... I did searches looking for the messageid (partial ab7c286efd66a363aa00797bfb) .. Can't find it...
Also searched by the userid that was supposed to receive it.

How else can I search...
Millennium Systems Replied
Merle,

If you have delivery logs sets to detailed you should be able to find that message there searching for the eml number, in this case 75769285
Merle Wait Replied
SO on the main server (not the inbound email server) .. I checked the delivery log...
I do not find 75769285   or  ab7c286efd66a363aa00797bfb)
'========================================================
Here is what is weird.....  From the MAIN.MAILSERVER.COM
I am pretty sure.. "Session=42855208      " is the session with the email that I am looking for....
**BEFORE ** anyone jumps to conclusion {that the server is not set up correctly}  please look at SESSION =53865602]where everything completed correctly.
'========================
16:52:07.207 [192.168.1.22][42855208] Connection initiated
16:52:07.207 [192.168.1.22][42855208] rsp: 220 main.mailserver.com
16:52:07.208 [192.168.1.22][42855208] connected at 9/24/2026 4:52:07 PM
16:52:07.228 [192.168.1.22][42855208] Country code: Unknown
16:52:07.228 [192.168.1.22][42855208] IP in whitelist
16:52:07.237 [192.168.1.22][42855208] cmd: EHLO inbound.server.com 
16:52:07.237 [192.168.1.22][42855208] rsp: 250-main.mailserver.com  Hello [192.168.1.22]250-SIZE 69905066250-AUTH PLAIN LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250-SMTPUTF8250-DSN250 OK
16:52:07.268 [192.168.1.22][42855208] cmd: STARTTLS
16:52:07.268 [192.168.1.22][42855208] rsp: 220 Start TLS negotiation
16:52:07.387 [192.168.1.22][42855208] cmd: EHLO inbound.server.com 
16:52:07.387 [192.168.1.22][42855208] rsp: 250-mail.mainserver.com Hello [192.168.1.22]250-SIZE 69905066250-AUTH PLAIN LOGIN CRAM-MD5250-8BITMIME250-SMTPUTF8250-DSN250 OK
16:52:07.423 [192.168.1.22][42855208] cmd: MAIL FROM:<clientj@mydomain.com> BODY=8BITMIME RET=HDRS ENVID=d666d735-a5e1-4236-9188-5f27d638a2f4 SIZE=3980
16:52:07.423 [192.168.1.22][42855208] senderEmail(1):clientj@mydomain.com
16:52:07.423 [192.168.1.22][42855208] rsp: 550 Authentication is required for relay
16:52:07.423 [192.168.1.22][42855208] disconnected at 9/24/2026 4:52:07 PM
Now, immediatily the next session starts

16:52:22.302 [192.168.1.22][53865602] Connection initiated
16:52:22.302 [192.168.1.22][53865602] rsp: 220 mail.mainmail.server.com
16:52:22.303 [192.168.1.22][53865602] connected at 9/24/2026 4:52:22 PM
16:52:22.319 [192.168.1.22][53865602] Country code: Unknown
16:52:22.319 [192.168.1.22][53865602] IP in whitelist
16:52:22.333 [192.168.1.22][53865602] cmd: EHLO mx1.ebt.net
16:52:22.333 [192.168.1.22][53865602] rsp: 250--mail.mainserver.com  Hello [192.168.1.22]250-SIZE 69905066250-AUTH PLAIN LOGIN CRAM-MD5250-STARTTLS250-8BITMIME250-SMTPUTF8250-DSN250 OK
16:52:22.364 [192.168.1.22][53865602] cmd: STARTTLS
16:52:22.364 [192.168.1.22][53865602] rsp: 220 Start TLS negotiation
16:52:22.440 [192.168.1.22][53865602] cmd: EHLO inbound.server.com
16:52:22.440 [192.168.1.22][53865602] rsp: 250-mail.availx.com Hello [192.168.1.22]250-SIZE 69905066250-AUTH PLAIN LOGIN CRAM-MD5250-8BITMIME250-SMTPUTF8250-DSN250 OK
16:52:22.452 [192.168.1.22][53865602] cmd: MAIL FROM:<A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com> BODY=8BITMIME RET=HDRS ENVID=799eb734-7114-44ef-af74-dd1db033aa2b SIZE=39840
16:52:22.452 [192.168.1.22][53865602] senderEmail(1): A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com
16:52:22.452 [192.168.1.22][53865602] rsp: 250 OK <A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com> Sender ok
16:52:22.452 [192.168.1.22][53865602] Sender accepted. Weight: 0. Block threshold: 30. 
16:52:22.483 [192.168.1.22][53865602] cmd: RCPT TO:<another@client.com> NOTIFY=FAILURE
16:52:22.484 [192.168.1.22][53865602] rsp: 250 OK <another@client.com> Recipient ok
16:52:22.513 [192.168.1.22][53865602] cmd: DATA
16:52:22.514 [192.168.1.22][53865602] Performing PTR host name lookup for 192.168.1.22
16:52:22.530 [192.168.1.22][53865602] PTR host name for 192.168.1.22 resolved as UnknownHost
16:52:22.530 [192.168.1.22][53865602] rsp: 354 Start mail input; end with <CRLF>.<CRLF>
16:52:22.551 [192.168.1.22][53865602] Parsed spamchecks from gateway, Null Sender=0,passed, _DMARC=0,passed, _DKIM=-2,Pass, _ARC=none, _customrules=, declude=-47
16:52:22.551 [192.168.1.22][53865602] senderEmail(2): les@outsidedomain.com parsed using FROM: REAL Southern Gospel < les@outsidedomain.com >
16:52:22.736 [192.168.1.22][53865602] DMARC Results: passed, Reason: Unknown, Reject? False
16:52:22.736 [192.168.1.22][53865602] rsp: 250 OK
16:52:22.737 [192.168.1.22][53865602] Received message size: 39882 bytes
16:52:22.738 [192.168.1.22][53865602] Successfully wrote to the HDR file. (L:/Smail/Spools/SubSpool2/53161707.hdr)
16:52:22.738 [192.168.1.22][53865602] Data transfer succeeded, writing mail to 53161707.eml (MessageID: <1142349068351.1142121742813.2110983223.0.321751JL.2002@synd.ccsend.com>)
16:52:22.748 [192.168.1.22][53865602] cmd: QUIT
16:52:22.748 [192.168.1.22][53865602] rsp: 221 OK
16:52:22.748 [192.168.1.22][53865602] disconnected at 9/24/2026 4:52:22 PM
'================================================
soooo not sure why one would say "relay not allowed"
To clarify, the user / domain received hundreds of emails per day... and is working fine


Douglas Foster Replied
This type of site-specific question is best handled as a support ticket.
I have not attempted to parse your logs, because much is lost by the forum's formatting, and I assume some portions of the log have been anonymized.
That said, there is only one plausible reason for the "relay not allowed" message  -- your inbound gateway accepts traffic for a domain that does not actually exist on your main server.   

I would suspect a missing domain alias, such as:   the inbound gateway accepts traffic for "example.com" and "example.co".  The main server is supposed to have a domain alias that maps "example.co" to "example.com", but that alias definition is missing or mangled (e.g. "example.c0")
Tony Scholz Replied
Employee Post Marked As Answer
Hello, 

In this example; 

16:52:07.423 [192.168.1.22][42855208] cmd: MAIL FROM:<clientj@mydomain.com> 
16:52:07.423 [192.168.1.22][42855208] senderEmail(1):clientj@mydomain.com
16:52:07.423 [192.168.1.22][42855208] rsp: 550 Authentication is required for relay

The MAIL FROM domain is a domain on the server that has "Require SMTP Authentication" enabled. 

This example; 

16:52:22.452 [192.168.1.22][53865602] cmd: MAIL FROM:<A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com> BODY=8BITMIME RET=HDRS ENVID=799eb734-7114-44ef-af74-dd1db033aa2b SIZE=39840
16:52:22.452 [192.168.1.22][53865602] senderEmail(1): A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com
16:52:22.452 [192.168.1.22][53865602] rsp: 250 OK <A7CK9DEolTv2FJRhcsScpoQ==_1142121742813_ijvFcNVGEfC27gJCpkIu2g==@in.constantcontact.com> Sender ok

Is not coming from a domain on your server. 

Thank you
Tony Scholz
Lead Network/System Administrator
SmarterTools Inc.

Reply to Thread

Enter the verification text