lost connection with 127.0.0.1 while sending end of data

[jpennock]

Yesterday morning, our server started deferring messages with lost connection with 127.0.0.1[127.0.0.1] while sending end of data -- message may be sent more than once.
We were running 5.0.9 on Centos 5. We narrowed it down to amavis - either the spam or virus, so thinking we needed to upgrade, we upgraded to 5.0.18. The server is still deferring messages. We edited the amavisd.conf.in file to disable the spam checking, and restarted zimbra and the messages are going through. Anyone have any ideas on how to check where the spam filter is having a problem?
Thanks in advance for any help.

[uxbod]

Welcome to the forums

Well, I would point to the ClamAV signatures first of all so you could try Zimbra Wiki :: Reset ClamAV definitions.

[jpennock]

I'm finally back on this problem - I appreciate the quick response, and I tried reseting the clamav definitions, but the problem is still here.
We have narrowed it down to the spam filter - if we edit /opt/zimbra/conf/amavisd.conf.in and uncomment the line:
%%comment SERVICE:antispam%% @bypass_spam_checks_maps = (1); # uncomment to DISABLE anti-spam code
then the mail flows through the server, but we get all the spam.

After reading and trying many of the ideas on the forum, I'm including the most commonly requested troubleshooting information:

host `hostname`
zimbra.mydomain.com has address 192.168.0.12

cat /etc/resolv.conf
nameserver 127.0.0.1

cat /etc/hosts
127.0.0.1 localhost.localdomain localhost
192.168.0.12 mail.mydomain.com zimbra mail

dig mydomain.com mx
; <<>> DiG 9.3.4-P1 <<>> mydomain.com mx
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46987
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;mydomain.com. IN MX

;; ANSWER SECTION:
mydomain.com. 300 IN MX 10 mail.mydomain.com.

;; AUTHORITY SECTION:
mydomain.com. 300 IN NS 192.168.0.12.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jul 30 15:21:51 2009
;; MSG SIZE rcvd: 91

dig mydomain.com any
; <<>> DiG 9.3.4-P1 <<>> mydomain.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1459
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;mydomain.com. IN ANY

;; ANSWER SECTION:
mydomain.com. 300 IN SOA mail.mydomain.com. jpennock.mydomain.com. 2009072802 10800 3600 604800 3600
mydomain.com. 300 IN NS 192.168.0.12.mydomain.com.
mydomain.com. 300 IN MX 10 mail.mydomain.com.
mydomain.com. 300 IN A 192.168.0.12

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jul 30 15:09:08 2009
;; MSG SIZE rcvd: 152

[jpennock]

I found a dns problem, and now here are the results of the common troubleshooting tips:

[root@mail ~]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
192.168.0.12 mail.mydomain.com mail

[root@mail ~]# cat /etc/resolv.conf
nameserver 192.168.0.12
#nameserver 127.0.0.1

[root@mail ~]# host `hostname`
mail.mydomain.com has address 192.168.0.12
mail.mydomain.com mail is handled by 10 mail.mydomain.com.

[root@mail named]# dig mail.mydomain.com any

; <<>> DiG 9.3.4-P1 <<>> mail.mydomain.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25754
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;mail.mydomain.com. IN ANY

;; ANSWER SECTION:
mail.mydomain.com. 300 IN SOA 192.168.0.12. jpennock.mydomain.com. 2009080501 10800 3600 604800 3600
mail.mydomain.com. 300 IN NS mail.mydomain.com.
mail.mydomain.com. 300 IN MX 10 mail.mydomain.com.
mail.mydomain.com. 300 IN A 192.168.0.12

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 192.168.0.12#53(192.168.0.12)
;; WHEN: Thu Aug 6 11:52:23 2009
;; MSG SIZE rcvd: 151

[root@mail named]# dig mail.mydomain.com mx

; <<>> DiG 9.3.4-P1 <<>> mail.mydomain.com mx
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61032
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;mail.mydomain.com. IN MX

;; ANSWER SECTION:
mail.mydomain.com. 300 IN MX 10 mail.mydomain.com.

;; AUTHORITY SECTION:
mail.mydomain.com. 300 IN NS mail.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 192.168.0.12#53(192.168.0.12)
;; WHEN: Thu Aug 6 11:52:48 2009
;; MSG SIZE rcvd: 78

If anyone has any suggestions, I welcome them.
Thanks in advance

[phoenix]

I found a dns problem, and now here are the results of the common troubleshooting tips:

What is the exact problem that you're encountering?

[root@mail named]# dig mail.mydomain.com any

That would be incorrect, you're using the FQDN of your server instead of the actual domain name.

You should modify your DNS records to reflect the fact your domain name would be 'domain.com' and the FQDN of your server is 'mail.mydomain.com'. Check the details in the Split DNS wiki article.

[jpennock]

Thanks for the reponse, the problem I'm having is that when the spam filter is enabled, mail from my domain to my domain ends up in the queue being deferred because of lost connection with 127.0.0.1. If I uncomment the line in /opt/zimbra/conf/amavisd.conf.in that says to uncomment to disable spam filtering, all the mail gets through.

i've updated the dns per the Split DNS wiki article, and here are the results:

[root@mail named]# dig mydomain.com a

; <<>> DiG 9.3.4-P1 <<>> mydomain.com a
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25553
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;mydomain.com. IN A

;; ANSWER SECTION:
mydomain.com. 300 IN A 192.168.0.12

;; AUTHORITY SECTION:
mydomain.com. 300 IN NS mail.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Aug 6 18:27:43 2009
;; MSG SIZE rcvd: 78

[root@mail named]# dig mydomain.com mx

; <<>> DiG 9.3.4-P1 <<>> mydomain.com mx
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51703
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;mydomain.com. IN MX

;; ANSWER SECTION:
mydomain.com. 300 IN MX 10 mail.mydomain.com.

;; AUTHORITY SECTION:
mydomain.com. 300 IN NS mail.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Aug 6 18:27:51 2009
;; MSG SIZE rcvd: 78

[root@mail named]# dig mydomain.com any

; <<>> DiG 9.3.4-P1 <<>> mydomain.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13037
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;mydomain.com. IN ANY

;; ANSWER SECTION:
mydomain.com. 300 IN SOA mail.mydomain.com. jpennock.mydomain.com. 2007012201 10800 3600 604800 3600
mydomain.com. 300 IN NS mail.mydomain.com.
mydomain.com. 300 IN A 192.168.0.12
mydomain.com. 300 IN MX 10 mail.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com. 300 IN A 192.168.0.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Aug 6 18:27:56 2009
;; MSG SIZE rcvd: 139

[cdmdotnet]

Did you ever get a solution to this problem you were having?

[dirkomatic]

I am also encountering this issue with certain servers. Did you find a solution to this?

[uxbod]

Welcome to the forums

Perhaps you could supply more information ? Which version of ZCS are you running ? Anything is your log files ?

[dirkomatic]

Thanks for the welcome.

Version 6.0

From /var/log/zimbra.log

Feb 23 06:28:12 prospoint postfix/qmgr[8937]: DD6372DA4B: from=, size=3875, nrcpt=1 (queue active)
Feb 23 06:28:12 prospoint amavis[23006]: (23006-01) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20100223T062812-23006:  ->  SIZE=3875 Received: from smtp.prospoint.com ([127.0.0.1]) by localhost (smtp.prospoint.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for ; Tue, 23 Feb 2010 06:28:12 -0500 (EST)
Feb 23 06:28:12 prospoint amavis[23006]: (23006-01) Checking: xv1rM3IVTijT [64.235.50.96]  -> 
Feb 23 06:28:12 prospoint postfix/smtp[5804]: DD6372DA4B: to=, orig_to=, relay=127.0.0.1[127.0.0.1]:10024, delay=17229, delays=17229/0.01/0.01/0.35, dsn=4.4.2, status=deferred (lost connection with 127.0.0.1[127.0.0.1] while sending end of data -- message may be sent more than once)
Feb 23 06:28:13 prospoint postfix/smtpd[5808]: connect from localhost[127.0.0.1]
Feb 23 06:28:13 prospoint postfix/smtpd[5808]: B2BB42DAED: client=localhost[127.0.0.1]

Oh, and this only has happened with two servers. It doesn't happen all the time, but it is consistent with the two servers which cause it.