cschantz
b5c6e015b4
- Performs DNS queries to check current listing status on RBLs - Reverses server IP octets for proper RBL query format - Uses dig with 3-second timeout for responsive checking - Only checks traditional RBLs (Spamhaus, Barracuda, SpamCop, SORBS, CBL) - Skips email provider checks (not queryable via DNS RBL) - Shows LISTED/CLEAN status with response codes for detailed info - Verifies if delisting was successful or if IP still blocked - Gracefully handles timeouts and DNS failures Response codes indicate: - 127.0.0.2: SBL (Spamhaus blocklist) - 127.0.0.3: CSS (Spamhaus CSS) - 127.0.0.10: PBL (Policy Blocklist) - Other codes: Varies by RBL provider Feature validates: 1. If IP extraction succeeded from rejection messages 2. Checks current status on active traditional RBLs 3. Provides clear indication of listing status 4. Suggests next steps based on results Users can now verify if their IP is CURRENTLY listed on each RBL, allowing them to confirm delisting success or identify remaining issues. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
1181 lines
47 KiB
Bash
Executable File
1181 lines
47 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
################################################################################
|
||
# Email Account/Domain Diagnostics
|
||
################################################################################
|
||
# Purpose: Verify email is working for specific address or domain
|
||
# Shows proof of delivery or identifies why emails aren't working
|
||
################################################################################
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||
source "$SCRIPT_DIR/lib/common-functions.sh"
|
||
source "$SCRIPT_DIR/lib/system-detect.sh"
|
||
source "$SCRIPT_DIR/lib/email-functions.sh"
|
||
|
||
show_banner "Email Diagnostics - Verify Email Delivery"
|
||
|
||
# Get mail log path
|
||
MAIL_LOG=$(get_mail_log_path)
|
||
if [ ! -f "$MAIL_LOG" ]; then
|
||
print_error "Mail log not found: $MAIL_LOG"
|
||
exit 1
|
||
fi
|
||
|
||
print_success "Using mail log: $MAIL_LOG"
|
||
echo ""
|
||
|
||
# Ask what to check
|
||
echo -e "${BOLD}What would you like to check?${NC}"
|
||
echo ""
|
||
echo " 1) Specific email address (e.g., user@example.com)"
|
||
echo " 2) Entire domain (e.g., example.com)"
|
||
echo ""
|
||
read -p "Enter choice [1]: " check_type
|
||
check_type=${check_type:-1}
|
||
|
||
# Get email/domain to check
|
||
echo ""
|
||
if [ "$check_type" = "2" ]; then
|
||
read -p "Enter domain to check (e.g., example.com): " target
|
||
search_pattern="@${target}"
|
||
check_label="domain $target"
|
||
else
|
||
read -p "Enter email address to check: " target
|
||
search_pattern="$target"
|
||
check_label="email $target"
|
||
fi
|
||
|
||
if [ -z "$target" ]; then
|
||
print_error "No email/domain provided"
|
||
exit 1
|
||
fi
|
||
|
||
# Time period to check
|
||
echo ""
|
||
echo "Check logs from:"
|
||
echo " 1) Last 1 hour"
|
||
echo " 2) Last 6 hours"
|
||
echo " 3) Last 24 hours (recommended)"
|
||
echo " 4) Last 48 hours"
|
||
echo " 5) Last week"
|
||
echo ""
|
||
read -p "Enter choice [3]: " time_choice
|
||
time_choice=${time_choice:-3}
|
||
|
||
case "$time_choice" in
|
||
1) hours=1 ;;
|
||
2) hours=6 ;;
|
||
3) hours=24 ;;
|
||
4) hours=48 ;;
|
||
5) hours=168 ;;
|
||
*) hours=24 ;;
|
||
esac
|
||
|
||
echo ""
|
||
print_info "Analyzing $check_label for last $hours hours..."
|
||
echo ""
|
||
|
||
# Calculate time cutoff
|
||
if date --version 2>&1 | grep -q "GNU"; then
|
||
# GNU date
|
||
cutoff_time=$(date -d "$hours hours ago" +"%Y-%m-%d %H:%M:%S")
|
||
else
|
||
# BSD date (macOS)
|
||
cutoff_time=$(date -v-${hours}H +"%Y-%m-%d %H:%M:%S")
|
||
fi
|
||
|
||
################################################################################
|
||
# Analysis
|
||
################################################################################
|
||
|
||
TEMP_MATCHES="/tmp/email_diag_$$.txt"
|
||
TEMP_AUTH="/tmp/email_auth_$$.txt"
|
||
TEMP_ALL="/tmp/email_all_$$.txt"
|
||
|
||
# Search multiple log files for comprehensive results
|
||
# Check Exim logs (email delivery)
|
||
if [ -f "/var/log/exim_mainlog" ]; then
|
||
grep -i "$search_pattern" /var/log/exim_mainlog >> "$TEMP_ALL" 2>/dev/null || true
|
||
fi
|
||
|
||
# Check maillog (Dovecot auth + some delivery)
|
||
if [ -f "/var/log/maillog" ]; then
|
||
grep -i "$search_pattern" /var/log/maillog >> "$TEMP_ALL" 2>/dev/null || true
|
||
fi
|
||
|
||
# Check messages log (fallback)
|
||
if [ -f "/var/log/messages" ]; then
|
||
grep -i "$search_pattern" /var/log/messages >> "$TEMP_ALL" 2>/dev/null || true
|
||
fi
|
||
|
||
# If we found nothing, fall back to the detected mail log
|
||
if [ ! -s "$TEMP_ALL" ]; then
|
||
grep -i "$search_pattern" "$MAIL_LOG" > "$TEMP_ALL" 2>/dev/null || true
|
||
fi
|
||
|
||
# Separate authentication events (IMAP/POP3 logins)
|
||
grep -E "imap-login|pop3-login|dovecot.*Login|Logged in|Disconnected" "$TEMP_ALL" > "$TEMP_AUTH" 2>/dev/null || true
|
||
|
||
# Get only email delivery events (exclude auth logs)
|
||
grep -v "imap-login\|pop3-login\|dovecot.*Login\|Logged in\|Disconnected" "$TEMP_ALL" > "$TEMP_MATCHES" 2>/dev/null || true
|
||
|
||
if [ ! -s "$TEMP_MATCHES" ]; then
|
||
print_error "NO EMAIL ACTIVITY FOUND for $check_label"
|
||
echo ""
|
||
echo "This means:"
|
||
echo " • No emails sent TO this $check_label"
|
||
echo " • No emails sent FROM this $check_label"
|
||
echo " • No delivery attempts logged"
|
||
echo ""
|
||
print_warning "Possible reasons:"
|
||
echo " 1. Email address/domain doesn't exist on this server"
|
||
echo " 2. No email activity in the last $hours hours"
|
||
echo " 3. Emails are going to a different mail server"
|
||
echo ""
|
||
|
||
# Check if domain exists
|
||
if [ "$check_type" = "2" ]; then
|
||
if grep -q "$target" /etc/localdomains 2>/dev/null || grep -q "$target" /etc/userdomains 2>/dev/null; then
|
||
print_info "Domain $target IS configured on this server"
|
||
else
|
||
print_warning "Domain $target NOT found in local domains"
|
||
fi
|
||
fi
|
||
|
||
rm -f "$TEMP_MATCHES" "$TEMP_AUTH" "$TEMP_ALL"
|
||
exit 0
|
||
fi
|
||
|
||
total_lines=$(wc -l < "$TEMP_MATCHES")
|
||
print_success "Found $total_lines log entries for $check_label"
|
||
echo ""
|
||
|
||
################################################################################
|
||
# Categorize activity
|
||
################################################################################
|
||
|
||
# Count different types first (sanitize to remove newlines)
|
||
delivered=$(grep -ci "=> .*$search_pattern\|delivered.*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
delivered=$(echo "$delivered" | head -1 | tr -d '\n\r')
|
||
sent=$(grep -ci "<=.*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
sent=$(echo "$sent" | head -1 | tr -d '\n\r')
|
||
# Only count actual email bounces, not auth failures or successful deliveries
|
||
bounced=$(grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed\|saved mail to\|=>" | grep -ci "550\|551\|552\|553\|554\|bounced\|Mail delivery failed\|** " 2>/dev/null || echo 0)
|
||
bounced=$(echo "$bounced" | head -1 | tr -d '\n\r')
|
||
deferred=$(grep -ci "deferred.*$search_pattern\|retry.*$search_pattern\|temporarily rejected" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
deferred=$(echo "$deferred" | head -1 | tr -d '\n\r')
|
||
rejected=$(grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed" | grep -ci "rejected RCPT\|rejected.*relay.*denied\|rejected.*spam" 2>/dev/null || echo 0)
|
||
rejected=$(echo "$rejected" | head -1 | tr -d '\n\r')
|
||
spf_fail=$(grep -ci "SPF.*fail.*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
spf_fail=$(echo "$spf_fail" | head -1 | tr -d '\n\r')
|
||
dkim_fail=$(grep -ci "DKIM.*fail.*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
dkim_fail=$(echo "$dkim_fail" | head -1 | tr -d '\n\r')
|
||
# Only count actually rejected spam, not spam delivered to spam folder
|
||
spam_rejected=$(grep -i "$search_pattern" "$TEMP_MATCHES" | grep -i "spam" | grep -ci "rejected\|blocked\|denied" 2>/dev/null || echo 0)
|
||
spam_rejected=$(echo "$spam_rejected" | head -1 | tr -d '\n\r')
|
||
greylist=$(grep -ci "greylist.*$search_pattern\|greylisted.*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
greylist=$(echo "$greylist" | head -1 | tr -d '\n\r')
|
||
received=$(grep -ci "=> .*$search_pattern" "$TEMP_MATCHES" 2>/dev/null || echo 0)
|
||
received=$(echo "$received" | head -1 | tr -d '\n\r')
|
||
|
||
# Count authentication events
|
||
auth_failed=$(grep -ci "auth failed\|Login aborted\|authentication failed" "$TEMP_AUTH" 2>/dev/null || echo 0)
|
||
auth_failed=$(echo "$auth_failed" | head -1 | tr -d '\n\r')
|
||
auth_success=$(grep -ci "Logged in\|Login:.*user=.*$search_pattern" "$TEMP_AUTH" 2>/dev/null || echo 0)
|
||
auth_success=$(echo "$auth_success" | head -1 | tr -d '\n\r')
|
||
|
||
################################################################################
|
||
# Quick Summary
|
||
################################################################################
|
||
|
||
print_header "QUICK SUMMARY"
|
||
echo ""
|
||
|
||
# Determine quick status
|
||
total_problems=$((bounced + rejected + spam_rejected))
|
||
total_email_activity=$((sent + received + delivered))
|
||
|
||
if [ "$total_email_activity" -gt 0 ] && [ "$total_problems" -eq 0 ]; then
|
||
print_success "Email appears to be working (${total_email_activity} email events, no problems)"
|
||
elif [ "$total_email_activity" -gt 0 ] && [ "$total_problems" -gt 0 ]; then
|
||
print_warning "Partial email issues (${total_email_activity} delivered, ${total_problems} failed)"
|
||
elif [ "$total_problems" -gt 0 ]; then
|
||
print_error "Email delivery problems detected (${total_problems} failures)"
|
||
elif [ "$auth_success" -gt 0 ] && [ "$total_email_activity" -eq 0 ]; then
|
||
print_info "Account active (${auth_success} logins) but no email traffic in last ${hours}h"
|
||
elif [ "$auth_failed" -gt 0 ]; then
|
||
print_warning "Failed login attempts detected (${auth_failed} attempts) - possible attack"
|
||
else
|
||
print_info "No activity detected in last ${hours} hours"
|
||
fi
|
||
|
||
echo ""
|
||
|
||
################################################################################
|
||
# Detailed Activity Breakdown
|
||
################################################################################
|
||
|
||
print_header "EMAIL DELIVERY ACTIVITY (last $hours hours)"
|
||
echo ""
|
||
|
||
# Always show main metrics for clarity
|
||
if [ "$received" -gt 0 ]; then
|
||
print_success "Received: $received emails (incoming TO this $check_label)"
|
||
else
|
||
echo "Received: 0 emails (no incoming mail)"
|
||
fi
|
||
|
||
if [ "$sent" -gt 0 ]; then
|
||
print_success "Sent: $sent emails (outgoing FROM this $check_label)"
|
||
else
|
||
echo "Sent: 0 emails (no outgoing mail)"
|
||
fi
|
||
|
||
if [ "$delivered" -gt 0 ]; then
|
||
print_success "Delivered: $delivered successful deliveries"
|
||
else
|
||
echo "Delivered: 0 (no completed deliveries logged)"
|
||
fi
|
||
|
||
echo ""
|
||
|
||
# Only show problems if they exist
|
||
has_problems=0
|
||
|
||
if [ "$bounced" -gt 0 ]; then
|
||
print_error "Bounced: $bounced emails bounced/failed"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$deferred" -gt 0 ]; then
|
||
print_warning "Deferred: $deferred emails temporarily delayed"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$rejected" -gt 0 ]; then
|
||
print_error "Rejected: $rejected emails blocked/rejected"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$spam_rejected" -gt 0 ]; then
|
||
print_error "Spam Rejected: $spam_rejected emails marked as spam"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$spf_fail" -gt 0 ]; then
|
||
print_warning "SPF Failures: $spf_fail authentication failures"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$dkim_fail" -gt 0 ]; then
|
||
print_warning "DKIM Failures: $dkim_fail signature failures"
|
||
has_problems=1
|
||
fi
|
||
|
||
if [ "$greylist" -gt 0 ]; then
|
||
print_info "Greylisted: $greylist emails temporarily delayed (normal anti-spam)"
|
||
fi
|
||
|
||
if [ $has_problems -eq 0 ]; then
|
||
print_success "No delivery problems detected"
|
||
fi
|
||
|
||
# Show email traffic patterns
|
||
if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
|
||
echo ""
|
||
print_header "EMAIL TRAFFIC PATTERNS"
|
||
echo ""
|
||
|
||
# Top recipients (who this email is sending to)
|
||
if [ "$sent" -gt 0 ]; then
|
||
print_info "Top 5 recipients (emails sent TO):"
|
||
grep -i "<= .*$search_pattern" "$TEMP_MATCHES" | grep -oE "=> [^@]+@[^ ]+" | sed 's/=> //' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
|
||
echo " $recipient - $count emails"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
# Top senders (who is sending to this email)
|
||
if [ "$received" -gt 0 ]; then
|
||
print_info "Top 5 senders (emails received FROM):"
|
||
grep -i "=> .*$search_pattern" "$TEMP_MATCHES" | grep -oE "<= [^@]+@[^ ]+" | sed 's/<= //' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
|
||
echo " $sender - $count emails"
|
||
done
|
||
echo ""
|
||
fi
|
||
fi
|
||
|
||
# Show authentication summary
|
||
if [ -s "$TEMP_AUTH" ]; then
|
||
echo ""
|
||
print_header "MAILBOX ACCESS ACTIVITY (IMAP/POP3 Logins)"
|
||
echo ""
|
||
print_info "This shows if customer can access their mailbox (not email delivery)"
|
||
echo ""
|
||
|
||
if [ "$auth_success" -gt 0 ]; then
|
||
print_success "Successful Logins: $auth_success (password is correct, mailbox accessible)"
|
||
fi
|
||
|
||
if [ "$auth_failed" -gt 0 ]; then
|
||
print_error "Failed Logins: $auth_failed (WRONG PASSWORD or brute-force attack)"
|
||
|
||
# Extract IPs attempting failed logins
|
||
failed_ips=$(grep -i "auth failed\|Login aborted" "$TEMP_AUTH" | grep -oE "rip=[0-9.]+|from [0-9.]+" | sed 's/rip=//; s/from //' | sort | uniq -c | sort -rn)
|
||
if [ -n "$failed_ips" ]; then
|
||
echo ""
|
||
print_warning "IPs with failed login attempts:"
|
||
echo "$failed_ips" | while read count ip; do
|
||
echo " $ip - $count attempts"
|
||
done
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
echo ""
|
||
|
||
################################################################################
|
||
# Account Status Check (for specific email addresses)
|
||
################################################################################
|
||
|
||
if [ "$check_type" != "2" ]; then
|
||
print_header "EMAIL ACCOUNT STATUS"
|
||
echo ""
|
||
|
||
# Extract username and domain from email
|
||
local_part=$(echo "$target" | cut -d'@' -f1)
|
||
domain_part=$(echo "$target" | cut -d'@' -f2)
|
||
|
||
# Check if email account exists in various locations
|
||
account_found=0
|
||
maildir=""
|
||
|
||
# Check cPanel mail directory
|
||
if [ -d "/home/*/mail/$domain_part/$local_part" ]; then
|
||
maildir=$(find /home/*/mail/$domain_part/$local_part -maxdepth 0 -type d 2>/dev/null | head -1)
|
||
if [ -n "$maildir" ]; then
|
||
account_found=1
|
||
fi
|
||
fi
|
||
|
||
# Check Plesk mail directory
|
||
if [ $account_found -eq 0 ] && [ -d "/var/qmail/mailnames/$domain_part/$local_part" ]; then
|
||
account_found=1
|
||
maildir="/var/qmail/mailnames/$domain_part/$local_part"
|
||
fi
|
||
|
||
# Check generic /var/mail
|
||
if [ $account_found -eq 0 ] && [ -f "/var/mail/$local_part" ]; then
|
||
account_found=1
|
||
maildir="/var/mail/$local_part"
|
||
fi
|
||
|
||
# If successful logins exist, account must exist (even if we can't find the directory)
|
||
if [ $account_found -eq 0 ] && [ "$auth_success" -gt 0 ]; then
|
||
account_found=1
|
||
print_success "Email account EXISTS (confirmed by successful logins)"
|
||
print_warning "Note: Mailbox directory not found in standard locations"
|
||
elif [ $account_found -eq 1 ]; then
|
||
print_success "Email account EXISTS on this server"
|
||
|
||
# Show mailbox details if we found the directory
|
||
if [ -n "$maildir" ] && [ -d "$maildir" ]; then
|
||
disk_usage=$(du -sh "$maildir" 2>/dev/null | awk '{print $1}')
|
||
if [ -n "$disk_usage" ]; then
|
||
print_info "Mailbox size: $disk_usage"
|
||
fi
|
||
|
||
# Count messages
|
||
msg_count=$(find "$maildir" -type f -name "*:2,*" 2>/dev/null | wc -l)
|
||
if [ "$msg_count" -gt 0 ]; then
|
||
print_info "Messages stored: $msg_count"
|
||
fi
|
||
|
||
# Check for quota file
|
||
quota_file=$(find "$maildir" -name "maildirsize" 2>/dev/null | head -1)
|
||
if [ -f "$quota_file" ]; then
|
||
quota_info=$(head -1 "$quota_file" 2>/dev/null)
|
||
print_info "Quota: $quota_info"
|
||
fi
|
||
fi
|
||
else
|
||
print_warning "Email account NOT FOUND on this server"
|
||
echo ""
|
||
echo "This could mean:"
|
||
echo " • Account doesn't exist (typo in email address?)"
|
||
echo " • Account is on a different mail server"
|
||
echo " • Mail is handled by external service (Google, Office365, etc.)"
|
||
fi
|
||
|
||
# Check for forwarders
|
||
if [ -f "/etc/valiases/$domain_part" ]; then
|
||
forwarder=$(grep "^$local_part:" "/etc/valiases/$domain_part" 2>/dev/null)
|
||
if [ -n "$forwarder" ]; then
|
||
echo ""
|
||
print_info "Forwarder configured:"
|
||
echo " $forwarder"
|
||
fi
|
||
fi
|
||
|
||
echo ""
|
||
fi
|
||
|
||
################################################################################
|
||
# Show verdict
|
||
################################################################################
|
||
|
||
print_header "DIAGNOSTIC RESULT"
|
||
echo ""
|
||
|
||
# Determine overall status
|
||
if [ "$delivered" -gt 0 ] && [ "$bounced" -eq 0 ] && [ "$rejected" -eq 0 ] && [ "$spam_rejected" -eq 0 ]; then
|
||
print_success "EMAIL IS WORKING PROPERLY"
|
||
echo ""
|
||
echo "Evidence: $delivered successful deliveries in the last $hours hours"
|
||
echo "No bounces, rejections, or spam filtering detected"
|
||
echo ""
|
||
|
||
elif [ "$delivered" -gt 0 ] && [ "$bounced" -gt 0 ]; then
|
||
print_warning "EMAIL PARTIALLY WORKING"
|
||
echo ""
|
||
echo "Some emails delivered ($delivered) but some failed ($bounced)"
|
||
echo "Check bounce reasons below for details"
|
||
echo ""
|
||
|
||
elif [ "$bounced" -gt 0 ] || [ "$rejected" -gt 0 ] || [ "$spam_rejected" -gt 0 ]; then
|
||
print_error "EMAIL HAS DELIVERY PROBLEMS"
|
||
echo ""
|
||
echo "Emails are being rejected, bouncing, or filtered as spam"
|
||
echo "See details below for why"
|
||
echo ""
|
||
|
||
elif [ "$deferred" -gt 0 ]; then
|
||
print_warning "EMAIL DELAYED"
|
||
echo ""
|
||
echo "Emails are being deferred (temporary failures)"
|
||
echo "This usually resolves itself within minutes"
|
||
echo ""
|
||
|
||
elif [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
|
||
print_info "EMAIL ACTIVITY DETECTED"
|
||
echo ""
|
||
echo "Email traffic logged but no delivery confirmations in last $hours hours"
|
||
echo "This may be normal depending on email volume"
|
||
echo ""
|
||
|
||
elif [ "$auth_success" -gt 0 ] || [ "$auth_failed" -gt 0 ]; then
|
||
print_info "MAILBOX ACCESS ONLY"
|
||
echo ""
|
||
echo "No email delivery activity, only mailbox access (IMAP/POP3) detected"
|
||
echo "This means the account exists and is being checked, but no emails sent/received"
|
||
echo ""
|
||
if [ "$auth_success" -gt 0 ]; then
|
||
echo "Authentication is working (customer can access mailbox)"
|
||
fi
|
||
if [ "$auth_failed" -gt 0 ]; then
|
||
echo "Failed login attempts detected (see details below)"
|
||
fi
|
||
echo ""
|
||
|
||
else
|
||
print_warning "NO EMAIL ACTIVITY FOUND"
|
||
echo ""
|
||
echo "No email sending, receiving, or mailbox access in the last $hours hours"
|
||
echo "Account may be inactive or not used during this time period"
|
||
echo ""
|
||
fi
|
||
|
||
################################################################################
|
||
# Show recent activity samples
|
||
################################################################################
|
||
|
||
if [ "$delivered" -gt 0 ]; then
|
||
print_header "RECENT SUCCESSFUL DELIVERIES (last 5 from past $hours hours)"
|
||
echo ""
|
||
print_info "PROOF - These emails were delivered recently:"
|
||
echo ""
|
||
grep -i "=> .*$search_pattern\|delivered.*$search_pattern" "$TEMP_MATCHES" | tail -5 | while read line; do
|
||
# Extract timestamp if present
|
||
timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
|
||
if [ -n "$timestamp" ]; then
|
||
echo -e " ${GREEN}[$timestamp]${NC} $line"
|
||
else
|
||
echo " $line"
|
||
fi
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$bounced" -gt 0 ]; then
|
||
print_header "DELIVERY FAILURE ANALYSIS"
|
||
echo ""
|
||
|
||
# Get all bounce lines
|
||
TEMP_BOUNCES="/tmp/email_bounces_$$.txt"
|
||
grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed\|saved mail to\|=>" | grep -i "550\|551\|552\|553\|554\|bounced\|Mail delivery failed\|** " > "$TEMP_BOUNCES" 2>/dev/null
|
||
|
||
# Categorize failures (sanitize counts to remove newlines)
|
||
recipient_unknown=$(grep -ci "user unknown\|No such user\|does not exist\|recipient rejected\|Recipient address rejected\|550.*User" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
|
||
recipient_unknown=$(echo "$recipient_unknown" | head -1 | tr -d '\n\r')
|
||
mailbox_full=$(grep -ci "mailbox.*full\|quota.*exceeded\|552\|insufficient.*space\|over.*quota" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
|
||
mailbox_full=$(echo "$mailbox_full" | head -1 | tr -d '\n\r')
|
||
relay_denied=$(grep -ci "relay.*denied\|relay.*not.*permitted\|relaying denied\|554.*relay" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
|
||
relay_denied=$(echo "$relay_denied" | head -1 | tr -d '\n\r')
|
||
# Only count actual blacklist/RBL rejections, exclude common false positives
|
||
blocked=$(grep -i "$TEMP_BOUNCES" -e "blacklist" -e "block list" -e "RBL" -e "DNSBL" -e "listed in" -e "blocked using" -e "on our block list" | \
|
||
grep -v "mailbox.*full\|quota.*exceeded\|authentication\|auth.*failed\|SPF.*fail\|DKIM.*fail\|user unknown\|does not exist\|relay.*denied\|content.*filter\|rejected due to content\|greylisted\|greylist" | \
|
||
wc -l 2>/dev/null || echo 0)
|
||
blocked=$(echo "$blocked" | head -1 | tr -d '\n\r')
|
||
dns_failure=$(grep -ci "domain.*not.*found\|Host.*unknown\|Name.*not.*resolve\|MX.*not.*found" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
|
||
dns_failure=$(echo "$dns_failure" | head -1 | tr -d '\n\r')
|
||
connection_fail=$(grep -ci "timeout\|connection.*refused\|connection.*failed\|Network.*unreachable" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
|
||
connection_fail=$(echo "$connection_fail" | head -1 | tr -d '\n\r')
|
||
|
||
print_info "Failure breakdown by reason:"
|
||
echo ""
|
||
|
||
if [ "$recipient_unknown" -gt 0 ]; then
|
||
print_error " Recipient doesn't exist: $recipient_unknown emails"
|
||
echo " Reason: Email address is invalid or doesn't exist on recipient server"
|
||
grep -i "user unknown\|No such user\|does not exist\|recipient rejected\|550.*User" "$TEMP_BOUNCES" | head -2 | while read line; do
|
||
echo " Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$mailbox_full" -gt 0 ]; then
|
||
print_warning " Mailbox full: $mailbox_full emails"
|
||
echo " Reason: Recipient's mailbox has exceeded storage quota"
|
||
grep -i "mailbox.*full\|quota.*exceeded\|552" "$TEMP_BOUNCES" | head -2 | while read line; do
|
||
echo " Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$relay_denied" -gt 0 ]; then
|
||
print_error " Relay denied: $relay_denied emails"
|
||
echo " Reason: Server not authorized to send to this domain"
|
||
echo " Solution: Check if server IP needs to be whitelisted"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$blocked" -gt 0 ]; then
|
||
print_error " Blocked/Spam filtered: $blocked emails"
|
||
echo " Reason: Sender IP or domain is blacklisted, or content flagged as spam"
|
||
echo ""
|
||
|
||
# Extract specific blacklists from rejection messages (strict filter to avoid false positives)
|
||
TEMP_BLACKLISTS="/tmp/email_blacklists_$$.txt"
|
||
grep -iE "blacklist|block list|RBL|DNSBL|listed in|blocked using|on our block list|S3150|S3140|AS\(48|CS01|local policy|gmail.*(suspicious|reputation|spam|detected).*reputation|gmail.*detected.*suspicious|spamhaus|barracuda|spamcop|sorbs|abuseat|yahoo.*block|yahoo.*reject|aol.*block|aol.*reject|me\.com.*reject|icloud.*reject|mac\.com.*reject|protonmail.*block|protonmail.*reject|pm\.me.*reject|zoho.*block|zoho.*reject|fastmail.*block|fastmail.*reject|outlook.*block|hotmail.*block|live\.com.*block|msn\.com.*block" "$TEMP_BOUNCES" > "$TEMP_BLACKLISTS" 2>/dev/null || true
|
||
|
||
# Try to extract server IP from rejection messages
|
||
extracted_ip=""
|
||
if grep -qiE '\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]|from [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$TEMP_BLACKLISTS" 2>/dev/null; then
|
||
extracted_ip=$(grep -oE '\[?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]?' "$TEMP_BLACKLISTS" 2>/dev/null | head -1 | tr -d '[]')
|
||
fi
|
||
|
||
if [ -s "$TEMP_BLACKLISTS" ]; then
|
||
# Blacklist/Provider detection with real-world message patterns
|
||
# Format: "name|display_name|removal_url|detection_keywords"
|
||
blacklist_db=(
|
||
# Traditional RBLs - Format: "id|name|url|patterns|difficulty|avg_time"
|
||
"spamhaus|Spamhaus (ZEN/SBL/XBL)|https://check.spamhaus.org/|spamhaus|sbl.spamhaus|zen.spamhaus|xbl.spamhaus|pbl.spamhaus|HARD|1-7 days"
|
||
"barracuda|Barracuda Central BRBL|https://www.barracudacentral.org/rbl/removal-request|barracuda|MODERATE|1-3 days"
|
||
"spamcop|SpamCop Blocking List|https://www.spamcop.net/bl.shtml|spamcop|bl.spamcop|EASY|Same day"
|
||
"sorbs|SORBS DNSBL|http://www.sorbs.net/lookup.shtml|sorbs|dnsbl.sorbs|MODERATE|1-2 days"
|
||
"cbl|CBL (Composite Block List)|https://cbl.abuseat.org/lookup.cgi|cbl.abuseat|abuseat|MODERATE|1-3 days"
|
||
"psbl|PSBL (Passive Spam Block List)|https://psbl.org/|psbl.surriel|psbl|MODERATE|1-2 days"
|
||
"uceprotect|UCEPROTECT Network|http://www.uceprotect.net/en/rblcheck.php|uceprotect|HARD|3-7 days"
|
||
"invaluement|Invaluement DNSBL|http://www.invaluement.com/removal/|invaluement|MODERATE|1-3 days"
|
||
"mailspike|Mailspike Blacklist|https://mailspike.net/anubis/lookup.html|mailspike|EASY|Same day"
|
||
"truncate|GBUdb (Truncate)|http://www.gbudb.com/|truncate.gbudb|gbudb|EASY|Same day"
|
||
"dnsrbl|DNSRBL.org|http://www.dnsrbl.org/|dnsrbl|MODERATE|1-2 days"
|
||
"backscatterer|Backscatterer.org|http://www.backscatterer.org/|backscatterer|EASY|Same day"
|
||
"dnswl|DNSWL (actually whitelist)|https://www.dnswl.org/|dnswl|N/A|N/A"
|
||
"mxtoolbox|MXToolbox Blacklist|https://mxtoolbox.com/blacklists.aspx|mxtoolbox|EASY|Same day"
|
||
|
||
# Major Email Providers (not traditional RBLs but they block based on reputation)
|
||
"microsoft|Microsoft/Outlook/Hotmail/Live Block|https://sendersupport.olc.protection.outlook.com/snds/|outlook.*block|hotmail.*block|live\.com.*block|msn\.com.*block|protection\.outlook.*block|on our block list|S3150|S3140|AS\(48|MODERATE|Same day"
|
||
"gmail|Gmail Reputation Filter|https://support.google.com/mail/contact/bulk_send_new|gmail.*suspicious|gmail.*reputation|gmail.*spam|gmail.*blocked|gmail.*detected|EASY|Same day"
|
||
"apple|Apple iCloud/me.com/mac.com Block|https://support.apple.com/|local policy|icloud.*reject|me\.com.*reject|mac\.com.*reject|CS01|HARD|3-7 days"
|
||
"yahoo|Yahoo/AOL Mail Block|https://senders.yahooinc.com/contact|yahoo.*block|yahoo.*reject|aol.*block|aol.*reject|verizonmedia.*block|MODERATE|1-2 days"
|
||
"zoho|Zoho Mail Block|https://www.zoho.com/mail/help/|zoho.*reject|zoho.*block|zohomail.*reject|EASY|Same day"
|
||
"protonmail|ProtonMail Block|https://protonmail.com/support/|protonmail.*reject|protonmail.*block|pm\.me.*reject|MODERATE|1-3 days"
|
||
"fastmail|Fastmail Block|https://www.fastmail.help/|fastmail.*reject|fastmail.*block|MODERATE|1-2 days"
|
||
"att|AT&T/SBC Block List|https://www.att.com/support/|att\.net.*block|sbcglobal.*block|MODERATE|1-3 days"
|
||
"comcast|Comcast/Xfinity Block|http://postmaster.comcast.net/|comcast.*block|xfinity.*block|MODERATE|1-3 days"
|
||
"cox|Cox Communications Block|https://www.cox.com/residential/support.html|cox\.net.*block|MODERATE|1-3 days"
|
||
"verizon|Verizon/Frontier Block|https://www.verizon.com/support/|verizon.*block|frontier.*block|MODERATE|1-3 days"
|
||
"spectrum|Spectrum/Charter Block|https://www.spectrum.net/support|spectrum.*block|charter.*block|rr\.com.*block|MODERATE|1-3 days"
|
||
)
|
||
|
||
detected_blacklists=""
|
||
|
||
# Check each blacklist pattern against rejection messages
|
||
for entry in "${blacklist_db[@]}"; do
|
||
IFS='|' read -r bl_id bl_name bl_url bl_patterns bl_difficulty bl_time <<< "$entry"
|
||
|
||
# Split patterns and check each one
|
||
matched=0
|
||
IFS='|' read -ra PATTERNS <<< "$bl_patterns"
|
||
for pattern in "${PATTERNS[@]}"; do
|
||
if grep -qiE "$pattern" "$TEMP_BLACKLISTS" 2>/dev/null; then
|
||
matched=1
|
||
break
|
||
fi
|
||
done
|
||
|
||
if [ $matched -eq 1 ]; then
|
||
detected_blacklists="${detected_blacklists}${bl_name}|${bl_url}|${bl_difficulty}|${bl_time}\n"
|
||
fi
|
||
done
|
||
|
||
if [ -n "$detected_blacklists" ]; then
|
||
print_warning " ⚠ SPECIFIC BLACKLISTS/BLOCKS DETECTED:"
|
||
echo ""
|
||
if [ -n "$extracted_ip" ]; then
|
||
print_info " Server IP detected: $extracted_ip"
|
||
echo ""
|
||
fi
|
||
echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
|
||
if [ -n "$bl_name" ]; then
|
||
# Format difficulty and time if available
|
||
if [ -n "$bl_difficulty" ] && [ -n "$bl_time" ]; then
|
||
print_error " • $bl_name [$bl_difficulty - $bl_time]"
|
||
else
|
||
print_error " • $bl_name"
|
||
fi
|
||
# Generate IP-specific lookup URL if IP was extracted
|
||
if [ -n "$extracted_ip" ]; then
|
||
case "$bl_url" in
|
||
*spamhaus.org*)
|
||
echo " Lookup: https://check.spamhaus.org/?ip=${extracted_ip}"
|
||
;;
|
||
*barracudacentral.org*)
|
||
echo " Lookup: https://www.barracudacentral.org/rbl/lookup?ip=${extracted_ip}"
|
||
;;
|
||
*spamcop.net*)
|
||
echo " Lookup: https://www.spamcop.net/query.html?ip=${extracted_ip}"
|
||
;;
|
||
*sorbs.net*)
|
||
echo " Lookup: http://www.sorbs.net/lookup.shtml?ip=${extracted_ip}"
|
||
;;
|
||
*)
|
||
echo " Removal/Info: $bl_url"
|
||
;;
|
||
esac
|
||
else
|
||
echo " Removal/Info: $bl_url"
|
||
fi
|
||
echo ""
|
||
fi
|
||
done
|
||
else
|
||
# Generic spam filter (not a specific blacklist)
|
||
echo " ℹ No specific blacklist detected in rejection message"
|
||
echo " May be content-based spam filtering or unlisted blacklist"
|
||
echo ""
|
||
fi
|
||
|
||
# Show example rejection messages
|
||
print_info " 📋 EXAMPLE REJECTION MESSAGES:"
|
||
echo ""
|
||
head -3 "$TEMP_BLACKLISTS" | while read line; do
|
||
# Truncate very long lines
|
||
echo " $(echo "$line" | cut -c1-120)"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
echo " 🔧 RECOMMENDED ACTIONS:"
|
||
echo " 1. Check your server IP against the detected blacklists above"
|
||
echo " 2. Visit removal/delisting URLs to submit requests"
|
||
echo " 3. Verify SPF/DKIM/DMARC records are correctly configured"
|
||
echo " 4. Check if server has been compromised (sending spam)"
|
||
echo " 5. Review mail queue for suspicious outbound emails"
|
||
echo ""
|
||
|
||
# Show removal request templates for detected blacklists
|
||
print_info " 📧 REMOVAL REQUEST TEMPLATES:"
|
||
echo ""
|
||
|
||
# Function to generate removal template based on blacklist
|
||
generate_removal_template() {
|
||
local bl_id="$1"
|
||
local server_ip="${2:-YOUR_SERVER_IP}"
|
||
local server_hostname="${3:-YOUR_SERVER_HOSTNAME}"
|
||
local admin_email="${4:-admin@YOUR_DOMAIN.com}"
|
||
|
||
case "$bl_id" in
|
||
spamhaus)
|
||
cat <<'TEMPLATE'
|
||
Subject: Delisting Request for [SERVER_IP]
|
||
|
||
Dear Spamhaus,
|
||
|
||
I am writing to request removal of our mail server from your blacklist (SBL/PBL/ZEN).
|
||
|
||
Server Details:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
|
||
Actions Taken:
|
||
1. Verified server is not an open relay
|
||
2. Secured server against compromise and abuse
|
||
3. Implemented SPF/DKIM/DMARC authentication records
|
||
4. Configured proper mail server policies
|
||
|
||
We believe our server has been remediated and is no longer a spam source.
|
||
Please review and remove our IP from your blocklist.
|
||
|
||
Thank you,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
microsoft)
|
||
cat <<'TEMPLATE'
|
||
Subject: Delisting Request - IP [SERVER_IP]
|
||
|
||
Hello Microsoft Sender Support,
|
||
|
||
I need to request removal of our mail server IP from the Microsoft/Outlook blocklist.
|
||
|
||
Server Information:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
- Organization: [YOUR_ORGANIZATION]
|
||
|
||
Remediation Completed:
|
||
1. Resolved the security issue causing the block
|
||
2. Verified server authentication (SPF/DKIM/DMARC)
|
||
3. Removed malicious content from mail queue
|
||
4. Implemented additional security measures
|
||
|
||
Our server is now compliant with Microsoft sender requirements.
|
||
Please restore our sending reputation.
|
||
|
||
Best regards,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
gmail)
|
||
cat <<'TEMPLATE'
|
||
Subject: Delisting Request - Mail Server [SERVER_IP]
|
||
|
||
Hello Gmail Support,
|
||
|
||
Our mail server [SERVER_IP] has been blocked due to reputation issues.
|
||
We have taken corrective action and request review for restoration.
|
||
|
||
Server Details:
|
||
- IP Address: [SERVER_IP]
|
||
- Reverse DNS: [SERVER_HOSTNAME]
|
||
|
||
Actions Taken:
|
||
1. Fixed authentication headers and message formatting
|
||
2. Implemented DKIM and DMARC signing on all outgoing mail
|
||
3. Improved bounce handling procedures
|
||
4. Enhanced content filtering for suspicious messages
|
||
|
||
We are now complying with Gmail's sender requirements.
|
||
Please re-evaluate our server reputation.
|
||
|
||
Thank you,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
apple)
|
||
cat <<'TEMPLATE'
|
||
Subject: Mail Server Delisting Request - [SERVER_IP]
|
||
|
||
Hello Apple Support,
|
||
|
||
Our organization's mail server [SERVER_IP] has been blocked by Apple's
|
||
mail filtering system. We have addressed the underlying issues.
|
||
|
||
Server Information:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
|
||
Remediation Steps Completed:
|
||
1. Verified message authentication (SPF/DKIM/DMARC records)
|
||
2. Reviewed and removed compromised accounts
|
||
3. Implemented additional security hardening
|
||
4. Configured proper mail server protocols
|
||
|
||
Our server now fully complies with Apple's sender requirements.
|
||
Please review and remove the block.
|
||
|
||
Sincerely,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
barracuda)
|
||
cat <<'TEMPLATE'
|
||
Subject: Delisting Request - [SERVER_IP]
|
||
|
||
Hello Barracuda Central,
|
||
|
||
Our mail server at [SERVER_IP] is listed in your Barracuda Reputation Block List.
|
||
We have remediated the issue and request delisting.
|
||
|
||
Server Details:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
|
||
Corrective Actions:
|
||
1. Fixed all authentication record issues (SPF/DKIM)
|
||
2. Reviewed and removed spam/malware from queue
|
||
3. Disabled any open relay vulnerabilities
|
||
4. Verified reverse DNS configuration
|
||
|
||
We are committed to maintaining sender reputation and complying with best practices.
|
||
Please review our request for removal.
|
||
|
||
Regards,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
yahoo)
|
||
cat <<'TEMPLATE'
|
||
Subject: Mail Server Delisting - [SERVER_IP]
|
||
|
||
Hello Yahoo Postmaster,
|
||
|
||
Our mail server [SERVER_IP] needs to be removed from Yahoo's block list.
|
||
We have taken steps to address the issue.
|
||
|
||
Server Information:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
|
||
Steps Taken:
|
||
1. Implemented proper email authentication (SPF/DKIM/DMARC)
|
||
2. Configured appropriate rate limiting policies
|
||
3. Reviewed mail queue for suspicious content
|
||
4. Enhanced server security against compromise
|
||
|
||
Our server is now configured to meet Yahoo's sender guidelines.
|
||
We request review of our IP for delisting.
|
||
|
||
Thank you,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
*)
|
||
cat <<'TEMPLATE'
|
||
Subject: Delisting Request - Mail Server [SERVER_IP]
|
||
|
||
Hello [BLOCKLIST_NAME] Support,
|
||
|
||
We are writing to request removal of our mail server [SERVER_IP] from your blocklist.
|
||
|
||
Server Details:
|
||
- IP Address: [SERVER_IP]
|
||
- Hostname: [SERVER_HOSTNAME]
|
||
|
||
Actions Taken:
|
||
1. Identified and fixed the issue causing the listing
|
||
2. Implemented proper authentication protocols
|
||
3. Enhanced security measures
|
||
4. Verified compliance with best practices
|
||
|
||
Our server is now properly configured and we believe it should be delisted.
|
||
Please review our request.
|
||
|
||
Sincerely,
|
||
[ADMIN_NAME]
|
||
[ADMIN_EMAIL]
|
||
TEMPLATE
|
||
;;
|
||
esac
|
||
}
|
||
|
||
# Show templates for each detected blacklist
|
||
echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
|
||
if [ -n "$bl_name" ]; then
|
||
# Extract ID from name (use first word as ID)
|
||
bl_id=$(echo "$bl_name" | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]')
|
||
|
||
echo " ─────────────────────────────────────────────────"
|
||
echo " 📧 Template for: $bl_name"
|
||
echo " ─────────────────────────────────────────────────"
|
||
generate_removal_template "$bl_id" "$extracted_ip" "mail.example.com" "admin@example.com"
|
||
echo ""
|
||
echo " 💡 Copy-paste instructions:"
|
||
echo " 1. Copy the template above"
|
||
echo " 2. Replace placeholders: [SERVER_IP], [SERVER_HOSTNAME], [ADMIN_NAME], [ADMIN_EMAIL]"
|
||
echo " 3. Submit to: $bl_url"
|
||
echo ""
|
||
fi
|
||
done
|
||
|
||
# Real-time blacklist status checking (if IP was extracted)
|
||
if [ -n "$extracted_ip" ]; then
|
||
echo ""
|
||
print_info " 🔍 REAL-TIME BLACKLIST STATUS CHECK:"
|
||
echo ""
|
||
echo " Checking current listing status for: $extracted_ip"
|
||
echo ""
|
||
|
||
# Function to check if IP is currently listed on a blacklist RBL
|
||
check_blacklist_listing() {
|
||
local ip="$1"
|
||
local rbl_host="$2" # e.g., zen.spamhaus.org
|
||
local rbl_name="$3" # e.g., Spamhaus
|
||
|
||
# Reverse the IP octets: 1.2.3.4 → 4.3.2.1
|
||
local reversed_ip=$(echo "$ip" | awk -F. '{print $4"."$3"."$2"."$1}')
|
||
|
||
# Query the RBL with a 3-second timeout
|
||
local query="${reversed_ip}.${rbl_host}"
|
||
local result=$(dig +short +timeout=3 "$query" A 2>/dev/null | head -1)
|
||
|
||
if [ -n "$result" ]; then
|
||
# IP is listed - return the response code
|
||
echo "LISTED:$result"
|
||
else
|
||
# IP is not listed
|
||
echo "CLEAN"
|
||
fi
|
||
}
|
||
|
||
# Parse RBL servers from blacklist entries and check each
|
||
echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
|
||
if [ -n "$bl_name" ]; then
|
||
# Extract RBL hostnames from URLs or use common patterns
|
||
case "$bl_name" in
|
||
*Spamhaus*)
|
||
rbl_host="zen.spamhaus.org"
|
||
short_name="Spamhaus"
|
||
;;
|
||
*Barracuda*)
|
||
rbl_host="bl.barracudacentral.org"
|
||
short_name="Barracuda"
|
||
;;
|
||
*SpamCop*)
|
||
rbl_host="bl.spamcop.net"
|
||
short_name="SpamCop"
|
||
;;
|
||
*SORBS*)
|
||
rbl_host="dnsbl.sorbs.net"
|
||
short_name="SORBS"
|
||
;;
|
||
*CBL*)
|
||
rbl_host="cbl.abuseat.org"
|
||
short_name="CBL"
|
||
;;
|
||
*)
|
||
# Skip email providers (not traditional RBLs)
|
||
continue
|
||
;;
|
||
esac
|
||
|
||
# Check current status
|
||
status=$(check_blacklist_listing "$extracted_ip" "$rbl_host" "$short_name")
|
||
|
||
if [[ "$status" == "LISTED"* ]]; then
|
||
response_code=$(echo "$status" | cut -d: -f2)
|
||
print_error " ✗ $short_name: CURRENTLY LISTED"
|
||
echo " Response: $response_code (meaning: check RBL for code details)"
|
||
echo " Action: Submit delisting request if not already done"
|
||
else
|
||
print_success " ✓ $short_name: NOT LISTED (Clean)"
|
||
fi
|
||
fi
|
||
done
|
||
|
||
echo ""
|
||
echo " 📌 Status Check Notes:"
|
||
echo " • DNS lookups may be cached - results reflect current RBL state"
|
||
echo " • Some RBLs may not respond within timeout window"
|
||
echo " • Check removal URLs above for detailed delisting status"
|
||
echo ""
|
||
fi
|
||
|
||
rm -f "$TEMP_BLACKLISTS"
|
||
fi
|
||
|
||
if [ "$dns_failure" -gt 0 ]; then
|
||
print_error " DNS/Domain issues: $dns_failure emails"
|
||
echo " Reason: Recipient domain doesn't exist or has no MX records"
|
||
grep -i "domain.*not.*found\|Host.*unknown" "$TEMP_BOUNCES" | head -2 | while read line; do
|
||
echo " Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$connection_fail" -gt 0 ]; then
|
||
print_warning " Connection failures: $connection_fail emails"
|
||
echo " Reason: Could not connect to recipient mail server (temporary)"
|
||
echo " Solution: These usually resolve themselves, check if persistent"
|
||
echo ""
|
||
fi
|
||
|
||
# Calculate uncategorized
|
||
total_categorized=$((recipient_unknown + mailbox_full + relay_denied + blocked + dns_failure + connection_fail))
|
||
if [ "$total_categorized" -lt "$bounced" ]; then
|
||
other=$((bounced - total_categorized))
|
||
print_warning " Other failures: $other emails"
|
||
echo " See detailed logs below for specific reasons"
|
||
echo ""
|
||
fi
|
||
|
||
# Show recent failures for reference
|
||
print_header "RECENT FAILURE EXAMPLES (last 3)"
|
||
echo ""
|
||
grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed\|saved mail to\|=>" | grep -i "550\|551\|552\|553\|554\|bounced\|Mail delivery failed\|** " | tail -3 | while read line; do
|
||
timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
|
||
if [ -n "$timestamp" ]; then
|
||
echo -e " ${RED}[$timestamp]${NC}"
|
||
# Extract the key error message
|
||
error_msg=$(echo "$line" | grep -oE "550 [^<]*|551 [^<]*|552 [^<]*|User unknown|does not exist|Mailbox full|relay denied" | head -1)
|
||
if [ -n "$error_msg" ]; then
|
||
echo " Error: $error_msg"
|
||
fi
|
||
recipient=$(echo "$line" | grep -oE '[^ ]+@[^ ,<>]+' | grep -v "$search_pattern" | head -1)
|
||
if [ -n "$recipient" ]; then
|
||
echo " To: $recipient"
|
||
fi
|
||
fi
|
||
echo ""
|
||
done
|
||
|
||
rm -f "$TEMP_BOUNCES"
|
||
fi
|
||
|
||
if [ "$rejected" -gt 0 ]; then
|
||
print_header "RECENT REJECTIONS (last 5)"
|
||
echo ""
|
||
grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed" | grep -i "rejected RCPT\|rejected.*relay.*denied\|rejected.*spam" | tail -5 | while read line; do
|
||
echo " $line"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$spam_rejected" -gt 0 ]; then
|
||
print_header "RECENT SPAM REJECTIONS (last 5)"
|
||
echo ""
|
||
print_info "Emails rejected as spam (not delivered):"
|
||
echo ""
|
||
grep -i "$search_pattern" "$TEMP_MATCHES" | grep -i "spam" | grep -i "rejected\|blocked\|denied" | tail -5 | while read line; do
|
||
timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
|
||
if [ -n "$timestamp" ]; then
|
||
echo -e " ${RED}[$timestamp]${NC} $line"
|
||
else
|
||
echo " $line"
|
||
fi
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$greylist" -gt 0 ]; then
|
||
print_header "RECENT GREYLISTING EVENTS (last 5)"
|
||
echo ""
|
||
print_info "Note: Greylisting is temporary - emails usually deliver after retry"
|
||
echo ""
|
||
grep -i "greylist" "$TEMP_MATCHES" | tail -5 | while read line; do
|
||
echo " $line"
|
||
done
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$spf_fail" -gt 0 ] || [ "$dkim_fail" -gt 0 ]; then
|
||
print_header "AUTHENTICATION ISSUES"
|
||
echo ""
|
||
if [ "$spf_fail" -gt 0 ]; then
|
||
echo "SPF failures detected:"
|
||
grep -i "SPF.*fail" "$TEMP_MATCHES" | head -3
|
||
echo ""
|
||
fi
|
||
if [ "$dkim_fail" -gt 0 ]; then
|
||
echo "DKIM failures detected:"
|
||
grep -i "DKIM.*fail" "$TEMP_MATCHES" | head -3
|
||
echo ""
|
||
fi
|
||
fi
|
||
|
||
################################################################################
|
||
# Recommendations
|
||
################################################################################
|
||
|
||
print_header "RECOMMENDATIONS"
|
||
echo ""
|
||
|
||
if [ "$bounced" -gt 0 ]; then
|
||
echo "To fix bounces:"
|
||
echo " 1. Verify the recipient email address is correct"
|
||
echo " 2. Check if recipient mailbox is full"
|
||
echo " 3. Ensure domain DNS is configured properly"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$rejected" -gt 0 ]; then
|
||
echo "To fix rejections:"
|
||
echo " 1. Check if server IP is blacklisted (use Blacklist Check tool)"
|
||
echo " 2. Verify SPF/DKIM/DMARC records are correct"
|
||
echo " 3. Check if recipient is blocking your domain"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$spf_fail" -gt 0 ]; then
|
||
echo "To fix SPF failures:"
|
||
echo " 1. Add this server's IP to domain's SPF record"
|
||
echo " 2. Use SPF/DKIM/DMARC Check tool for details"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$spam_rejected" -gt 0 ]; then
|
||
echo "To fix spam rejections:"
|
||
echo " 1. Check SpamAssassin score and adjust settings"
|
||
echo " 2. Verify email content isn't triggering spam filters"
|
||
echo " 3. Ensure proper SPF/DKIM authentication"
|
||
echo " 4. Check if sending domain has good reputation"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$greylist" -gt 0 ] && [ "$delivered" -eq 0 ]; then
|
||
echo "Greylisting delays:"
|
||
echo " • This is normal anti-spam behavior"
|
||
echo " • Emails should deliver after sender retries (5-15 minutes)"
|
||
echo " • No action needed unless emails never arrive"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "${check_type:-1}" != "2" ] && [ "${account_found:-0}" -eq 0 ]; then
|
||
echo "Email account not found:"
|
||
echo " 1. Verify the email address is spelled correctly"
|
||
echo " 2. Check if domain DNS points to this server"
|
||
echo " 3. Create the email account if it should exist here"
|
||
echo " 4. Check if mail is handled by external service"
|
||
echo ""
|
||
fi
|
||
|
||
if [ "$auth_failed" -gt 0 ]; then
|
||
echo "Failed login attempts detected:"
|
||
echo " 1. Customer may be using wrong password"
|
||
echo " 2. Could be brute-force attack attempt"
|
||
echo " 3. Check IPs - block suspicious ones with firewall"
|
||
echo " 4. Advise customer to change password if compromised"
|
||
echo ""
|
||
fi
|
||
|
||
################################################################################
|
||
# Save full report
|
||
################################################################################
|
||
|
||
REPORT_FILE="/tmp/email_diag_${target//[@.]/_}_$(date +%Y%m%d_%H%M%S).txt"
|
||
cp "$TEMP_MATCHES" "$REPORT_FILE"
|
||
|
||
print_info "Full log saved to: $REPORT_FILE"
|
||
echo ""
|
||
|
||
# Cleanup
|
||
rm -f "$TEMP_MATCHES" "$TEMP_AUTH" "$TEMP_ALL" "$TEMP_BOUNCES"
|