Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The IP of one of our servers has been blacklisted and I would like to attempt to work out why. There are many Apache virtualhosts on the server so the logging would need to be split up by domain and if possible include the PHP script file name that initiated the mail call.

The mail server is Qmail and the server is running Redhat Linux.

Is this possible? If so please detail how to achieve this.


share|improve this question
up vote 1 down vote accepted

Ended up going the sendmail wrapper route using the following resource:

There is a way to find what the folder the PHP script that sends mail was run from. Note, the paths can be slightly differ from the listed below depending on your OS and Plesk version:

1) create /var/qmail/bin/sendmail-wrapper script with the content:

!/bin/sh (echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/var/qmail/bin/sendmail-qmail "$@"

Note, it should be the two lines including '#!/bin/sh'. 2) then create log file /var/tmp/mail.send and grant it "a+rw" rights, make the wrapper e> xecutable, rename old sendmail and link it to the new wrapper: ~# touch /var/tmp/mail.send ~# chmod a+rw /var/tmp/mail.send ~# chmod a+x /var/qmail/bin/sendmail-wrapper ~# mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail ~# ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail 3) Wait for an hour or so and revert sendmail back:

~# rm -f /var/qmail/bin/sendmail ~# ln -s /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail

Examine /var/tmp/mail.send file, there should be lines starting with "X-Additional-Header:" pointing out to domains' folders where the scripts which sent the mail are located. You can see all the folders mail PHP scripts were run from with the following command:

~# grep X-Additional /var/tmp/mail.send | grep cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e 's/HTTPD_VHOSTS_D//'

f you see no output from the command above, it means that no mail was sent using PHP mail() function from the Plesk virtual hosts directory.

share|improve this answer

I don't know about logging the PHP script or any of the webserver-related bits, but qmail (and pretty much every other MTA) typically logs what was sent -- at least the MAIL FROM & RCPT TO addresses & the mail server it handed the message off to.

You can probably parse your qmail logs to have an idea of what was/is being sent that could have gotten you blacklisted.
Additionally if you know which blacklist(s) you're on that may give you a clue as to what was going on.

share|improve this answer
I thought of the qmail logs, but it doesn't appear to be logging. I really need to be able to split the logs by source as well. So that could be VHost name or pwd (the directory it was executed in). – Treffynnon Apr 11 '11 at 14:01
If your mail server isn't logging (at a minimum) the MAIL FROM / RCPT TO addresses & the server it's handing the message off to you should probably fix that - it's the path of least resistance for troubleshooting anything mail-related :-). Re: splitting the log, you can do that based on the MAIL FROM address (which may not be 100% accurate, but it's a good start) - doing more may require some custom hackery in either PHP, qmail or both... – voretaq7 Apr 11 '11 at 14:10

If you're running PHP 5.3 or later you can have PHP log all the info you're looking for automatically, no wrapper scripts required:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.