I have a Postfix mail server running, and I'm trying to understand why emails sent to
email@example.com are actually sent to
On the command line, I send a simple test email:
echo test | mail -s test firstname.lastname@example.org
maillog, I see:
Mar 20 23:40:57 some-server sendmail: r2L3euXm029680: from=root, size=48, class=0, nrcpts=1, msgid=<201303210340.r2L3euXm029680@some-server.example.com>, relay=root@localhost
So I understand that sendmail is used to send the email, and my Postfix server will receive it.
I enabled the verbose option in Postfix, so I have pretty long logs, but the part that strike me as wrong is this:
Mar 20 23:40:57 some-server postfix/smtpd: < localhost.localdomain[127.0.0.1]: MAIL From:<email@example.com> SIZE=48 AUTHfirstname.lastname@example.org Mar 20 23:40:57 some-server postfix/smtpd: > localhost.localdomain[127.0.0.1]: 250 2.1.0 Ok Mar 20 23:40:57 some-server postfix/smtpd: < localhost.localdomain[127.0.0.1]: RCPT To:<email@example.com>
So the From part is OK; I'm testing from root, and the machine hostname is
some-server.example.com, but who changed the
TO email address from
From what I understand from the log, that last line is a command received by Postfix from sendmail. So why is sendmail saying I want to send to that address, when I asked for something else on the command line?
This returns nothing but comments:
grep -ri some-server /etc/mail /etc/postfix
I also tried to send emails to
firstname.lastname@example.org, and it also gets rewritten as
email@example.com, so the problem is with the host, not the user, getting re-written.
I'll be happy to provide more logs if needed. Just let me know what to try and what logs would be useful to understand what is happening.
If I try
sendmail -bt, and enter
check_mail <firstname.lastname@example.org>, I get this:
... Canonify2 input: myself < @ example . com > Canonify2 returns: myself < @ some-server . example . com . > ...
Not sure what that means.
I read somewhere that domains re-writing could be cause by a wildcard MX entry in the domain. I indeed had that, and have since removed it. It didn't resolve the problem, but maybe there is a delay in the propagation (even if dig seems to indicate propagation is now complete).