Home / server / Questions / 1079496
Accepted
markhorrocks
Asked: 2021-10-05 05:42:50 +0800 CST

In Postfix, how can I find the recipient address using Message-ID?

  • 772

I have an abuse report for an email which only contains a message ID. How can I find the recipient email address in Postfix sent emails?

I searched the logs with cat /var/log/mail.log } grep [ID] -C 20 but the message details I see do not appear to be the right email because the mail server host does not match the abuse report.. I can't determine if I'm getting the queue ID or the message ID.

postfix

1 Answers

  1. Best Answer

    Grepping logs with Message-ID will give you a Postfix Queue ID:

    # grep XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mail.log
Oct  3 00:10:48 mx postfix/cleanup[25302]: YYYYYYYYYY: message-id=<XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX>

    YYYYYYYYYY is the Queue ID here. Now you have to grep again:

    # grep YYYYYYYYYY mail.log
Oct  3 00:10:48 mx postfix/smtpd[25294]: YYYYYYYYYY: client=????????????????????
Oct  3 00:10:48 mx postfix/cleanup[25302]: YYYYYYYYYY: message-id=<XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX>
Oct  3 00:10:48 mx postfix/qmgr[30545]: YYYYYYYYYY: from=<[email protected], ...
Oct  3 00:10:48 mx postfix/lmtp[25306]: YYYYYYYYYY: to=<[email protected]>, ...
Oct  3 00:10:48 mx postfix/qmgr[30545]: YYYYYYYYYY: removed

    As you see, grepping with either one doesn't differ much. Notice, external actors likely to tell you Message ID, because they may be unaware of your internal Queue ID.

    In my case lmtp logged the recipient address because this was locally delivered mail with LMTP, but in case of ougoing mail the service that should log the "to" address could be smtp.

    In any case, -C may not help, because there could be lines that intervene with this mail processing. Also, notice, normally log files get rotated, so you may need to look up in older files, mail.log.1 and so on. Old files might be compressed, so use for example zgrep YYYYYYYYYY mail.log.2.gz, or whatever on your system it is.

    • 2