Mail Logs & Trace

Mail Logs

The Mail Logs page provides a searchable view of all mail log entries from the Postfix log, aggregated cluster-wide.

Filters

Filter	Description
Time Range	From-to selection (default: last 24 hours)
Sender	Filter by envelope-from address (substring)
Recipient	Filter by recipient address
Queue ID	Search for a specific Postfix queue ID
Status	sent, bounced, deferred, rejected, spam
Node	Restrict to a single cluster node
Postscreen	Show/hide Postscreen events (default: hidden)

Columns

Column	Description
Time	Log timestamp
Source	mta / spam-filter / postscreen / submission / other
Queue ID	Postfix internal ID
From	Envelope sender (masked depending on role)
To	Recipient (masked depending on role)
Subject	Subject line (masked depending on role)
Status	Delivery status with colour coding (green = sent, red = rejected/spam, yellow = deferred)
Processing Time	Milliseconds from receipt to delivery
Node	Origin node

Status Colours

Status	Colour	Meaning
sent	Green	Successfully delivered
spam	Red	Quarantined or rejected due to spam
rejected	Red	Policy or RBL rejection
bounced	Orange	Bounce/DSN sent
deferred	Yellow	Temporarily failed

Expandable Row

Clicking a row opens the detail view with the full last log entry, detected RBL hits (extracted from Postscreen messages), and virus detection status.

Privacy Masking

Sender, recipient, and subject are displayed masked depending on the user role (as described in Training).

Quick Filter (Create Sender Filter Quickly)

The Filter icon (⊕) at the right edge of each mail log row allows creating a sender filter instantly:

1. Click the icon → modal opens with sender and recipient pre-filled
2. Choose Allowlist or Blocklist
3. Optionally switch from full sender address to sender domain only
4. Save → filter is created as a recipient-specific filter (user_email = recipient address)

Per-recipient filter

The quick filter always creates a recipient-specific filter — it applies only to mails to that one recipient, not globally. Global filters are created directly under Mail Filters → Sender Filters.

Mail Trace

The Mail Trace follows a single message through all Postfix queues on its way through the system. nmg can generate three different queue IDs for one message:

Internet → [Postfix port 25] → Queue ID 1 (inbound hop)
         → [rspamd milter scan]
         → [Hold (quarantine) OR reinject port 10025]
         → Queue ID 2 (after sandbox/YARA)
         → [Reinject port 10026 / transport]
         → Queue ID 3 (final delivery)

Usage

1. Open Mail Trace
2. Enter sender address, recipient address, subject (substring), or queue ID
3. Select the message in the result list
4. The trace shows every hop with timestamp, queue ID, action, and node

Stage Labels

Stage	Meaning
domain	Domain lookup and routing decision
sender_filter	Sender filter check (allow/block list)
sandbox_whitelist	Sandbox allow-list check
rspamd	rspamd spam filter result
sandbox	YARA sandbox analysis
delivery	Final delivery or quarantine

Stage Status Colours

Status	Colour	Meaning
ok	Green	Stage passed without findings
warn	Yellow	Anomaly detected, but no block
block	Red	Mail was blocked at this stage
error	Red	Technical error at this stage
skip	Grey	Stage skipped (not applicable)

End Verdict

After the trace, a coloured banner is shown: - Green: Mail successfully delivered - Orange: Mail quarantined - Red: Mail permanently rejected