Postfix&Dovecot环境下经外部垃圾过滤器转发的别名/转发账户邮件丢失问题求助

各位大佬好，我已经折腾这个邮件问题两天了，实在没辙了，来求助大家！

我的服务器环境是：

• CentOS Linux release 7.9.2009
• Plesk 18.0.50
• Postfix + Dovecot

目前大部分邮件都能正常收发，但遇到一个诡异的情况：经外部垃圾过滤器（Mail Assure）转发到别名/转发账户的邮件，日志显示已经投递成功，但实际根本不在用户的邮箱里，服务器上也找不到任何痕迹。

具体情况及排查过程 #

1. 垃圾过滤器日志确认邮件已投递

首先看Mail Assure的日志，明确显示邮件已经成功投递到我的服务器：

1pZZdb-0002Mt-IH
myolddomain.com
2023-03-07 07:54
notify@payments.interac.ca
luke
allowlisted
INTERAC e-Transfer: LUKE PITTMAN cancelled the money transfer sent to you.
delivered

2. 服务器maillog显示Postfix已投递成功

对应服务器上的/var/log/maillog日志，Postfix记录显示邮件通过plesk_virtual服务投递成功：

Mar  7 07:54:29 server postfix/smtpd[27797]: connect from delivery.mtaroutes.com[185.201.16.200]
Mar  7 07:54:30 server postfix/smtpd[27797]: CB260BC4006B: client=delivery.mtaroutes.com[185.201.16.200]
Mar  7 07:54:31 server postfix/cleanup[28935]: CB260BC4006B: message-id=<248542808.92042284.1678204442900@6ea0c801e2d0>
Mar  7 07:54:31 server postfix/qmgr[14249]: CB260BC4006B: from=<notify@payments.interac.ca>, size=62814, nrcpt=1 (queue active)
Mar  7 07:54:31 server postfix/pipe[28941]: CB260BC4006B: to=<luke@myolddomain.com>, relay=plesk_virtual, delay=0.67, delays=0.63/0/0/0.04, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Mar  7 07:54:31 server postfix/qmgr[14249]: CB260BC4006B: removed
Mar  7 07:54:31 server postfix/smtpd[27797]: disconnect from delivery.mtaroutes.com[185.201.16.200] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=2 quit=1 commands=8

3. 服务器上完全找不到该邮件

我到用户的邮箱目录下搜索这个邮件的队列ID，结果什么都没找到：

-bash-4.2# cd /var/qmail/mailnames/mynewdomain.com/luke
-bash-4.2# grep -R CB260BC4006B ./*
-bash-4.2#

甚至跑到服务器根目录下全局搜索，还是没有任何结果。为了确认搜索命令没问题，我找了一封正常收到的邮件测试，能成功找到：

-bash-4.2# grep -R 134D4BC4006F ./*
./Maildir/cur/1678205924.M212491P6629.server.mydomain.com,S=7790,W=7925:2,: id 134D4BC4006F; Tue,  7 Mar 2023 08:18:44 -0800 (PST)

4. 更诡异的对比测试

当我跳过外部垃圾过滤器，直接给这个别名/转发账户发邮件时，maillog里的记录几乎一模一样，但邮件能正常出现在用户邮箱里！这说明问题大概率出在垃圾过滤器对邮件的修改上——可能是添加了某些特殊头信息，或者修改了邮件内容，导致plesk_virtual服务把邮件悄悄丢弃了，但我实在找不到线索。

附上Postfix配置信息 #

postconf -n 输出

alias_maps = hash:/etc/aliases, nis:mail.aliases, hash:/var/spool/postfix/plesk/aliases
authorized_flush_users =
authorized_mailq_users =
command_directory = /usr/sbin
compatibility_level = 2
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
disable_vrfy_command = yes
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 51200000
meta_directory = /etc/postfix
mydestination = localhost.$mydomain, localhost, localhost.localdomain
mynetworks =
newaliases_path = /usr/bin/newaliases.postfix
plesk_virtual_destination_recipient_limit = 1
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-3.5.14/README_FILES
recipient_canonical_classes = envelope_recipient,header_recipient
recipient_canonical_maps = tcp:127.0.0.1:12346
recipient_delimiter =
sample_directory = /usr/share/doc/postfix-3.5.14/samples
sender_dependent_default_transport_maps = hash:/var/spool/postfix/plesk/sdd_transport_maps
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_send_xforward_command = yes
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_authorized_xforward_hosts = 127.0.0.0/8 [::1]/128
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
smtpd_milters = inet:127.0.0.1:12768
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists, permit_sasl_authenticated
smtpd_tls_cert_file = /etc/postfix/postfix.pem
smtpd_tls_ciphers = medium
smtpd_tls_dh1024_param_file = /usr/local/psa/etc/dhparams2048.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = TLSv1.2
smtpd_tls_protocols = TLSv1.2
smtpd_tls_security_level = may
smtpd_use_tls = yes
smtputf8_enable = no
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
tls_preempt_cipherlist = yes
tls_server_sni_maps = hash:/var/spool/postfix/plesk/certs
tls_ssl_options = no_compression
transport_maps = , hash:/var/spool/postfix/plesk/transport
unknown_local_recipient_reject_code = 550
virtual_alias_maps = $virtual_maps, hash:/var/spool/postfix/plesk/virtual
virtual_gid_maps = static:30
virtual_mailbox_base = /var/qmail/mailnames
virtual_mailbox_domains = $virtual_mailbox_maps, hash:/var/spool/postfix/plesk/virtual_domains
virtual_mailbox_limit = 0
virtual_mailbox_maps = , hash:/var/spool/postfix/plesk/vmailbox
virtual_transport = plesk_virtual
virtual_uid_maps = static:30

postconf -M 输出

smtp       inet  n       -       n       -       -       smtpd
cleanup    unix  n       -       n       -       0       cleanup
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp -o syslog_name=postfix/$service_name
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache
postlog    unix-dgram n  -       n       -       1       postlogd
plesk_virtual unix -     n       n       -       -       pipe flags=DORhu user=popuser:popuser argv=/usr/lib64/plesk-9.0/postfix-local -f ${sender} -d ${recipient} -p /var/qmail/mailnames -q ${queue_id}
127.0.0.1:12346 inet n   n       n       -       -       spawn user=popuser:popuser argv=/usr/lib64/plesk-9.0/postfix-srs
mailman    unix  -       n       n       -       -       pipe flags=R user=mailman:mailman argv=/usr/lib64/plesk-9.0/postfix-mailman ${nexthop} ${user} ${recipient}
pickup     fifo  n       -       n       60      1       pickup
qmgr       fifo  n       -       n       1       1       qmgr
smtps      inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes
submission inet  n       -       n       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=may -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
plesk_saslauthd unix y   y       n       -       1       plesk_saslauthd status=5 listen=6 dbpath=/var/spool/postfix/plesk/passwd.db
plesk-158.69.12.128- unix - -    n       -       -       smtp -o smtp_bind_address=158.69.12.128 -o smtp_bind_address6= -o smtp_address_preference=ipv4
plesk-54.39.48.83- unix - -      n       -       -       smtp -o smtp_bind_address=54.39.48.83 -o smtp_bind_address6= -o smtp_address_preference=ipv4

现在我已经把能想到的排查步骤都做了，实在摸不清问题出在哪，有没有大佬能给点排查方向或者思路？感激不尽！

备注：内容来源于stack exchange，提问作者Luke Pittman