Why do I see emails "to=<amavis@mail.example.com>" in my logs?

[blakegonzales]

DMS v13.0.1 is running great and I'm not having any issues. Spam is getting classified well and moved into Junk automatically. I'm not missing any emails that I'm aware of. All is good. There is just the matter of some log entries that I'm curious about.

Also, my setup includes the changes suggested here - https://docker-mailserver.github.io/docker-mailserver/latest/faq/#how-can-i-make-spamassassin-better-recognize-spam ... except for docker-data/dms/config/amavis.cf has my local email address blake\@example.com instead of amavis\@example.com

So, I have some noob questions here...

• Why do I see a few emails a day to=<amavis@mail.example.com> in my logs?
• What is the content of these emails?
• Where are these emails going? (there are no amavis@mail.example.com or amavis@example.com accounts created)
• Is this normal?

Thanks!
Blake

[casperklein]

I am on the go so only a very brief answer:

Is this normal?

I think so

Where are these emails going?

Nowhere at the moment. You should create an alias, pointing to a real address: ./setup.sh alias add amavis somerealaddress@yourdomain.com

What is the content of these emails?

Take a look after creating the alias. IIRC it informs about mails that were quarantined.

PS: There were discussions/open issues about this in the past, you may look for them also.

[blakegonzales]

Thank you! Your brief answer helped immensely 😀

[polarathene]

• Where are these emails going? (there are no amavis@mail.example.com or amavis@example.com accounts created)

They end up in /var/mail delivered by Postfix (but not to Dovecot like your other mail).

This is because of the @mail.example.com hostname set for DMS. If you follow the FAQ advice on bare domain config instead Postfix will ask Dovecot about an amavis account to deliver to @example.com and since one doesn't exist it'd fail the delivery.

It succeeds to /var/mail though as the default with mail.example.com is for internal / local system mail. Any system account that sends mail (often to/from root) will go this route. Postfix checks if the account exists (/etc/passwd IIRC) and since it does, the mail is delivered to /var/mail.

Our docs should say somewhere about adding an alias for Postmaster (which mail for root should get aliased to implicitly by us), but might not mention Amavis. Those aliases are configured in a different file as they're separate from what setup alias add would be used for (virtual aliases), but virtual aliases get resolved after that IIRC so works too.

[blakegonzales]

Love this explanation. I checked and there was mail for amavis in /var/mail!

I think now that I've setup an amavis alias to somerealaddress@yourdomain.com as @casperklein suggested, I won't see email anymore in /var/mail/amavis.

Just in case, I've setup a crontab script to check existence of /var/mail/amavis and email me if it exists.

[polarathene]

Just remember it could be mail for other system accounts too IIRC, although I think it's rare that we see mail for anything else.

[blakegonzales]

Good call. I'm going to modify my crontab script to alert on any systems account emails in /var/mail

[blakegonzales]

This crontab entry works great for email notification of all non-dovecot (or specifically non-directory) accounts that may appear in /var/mail.

# notify if other users have mail
0 * * * * docker exec mailserver find /var/mail -maxdepth 1 -type f -exec mail name@example.com -s "{} exists." \;