[Rspamd-Users] Lots(?) of MX_INVALID messages

[lists.rspamd.com at masquerade.email]

On Wed, 2023-11-29 at 12:29 +0100, Ralf Hildebrandt via Users wrote:
> I was wondering about the MX_INVALID symbol, so I checked my logs:
> 
> # xzegrep -c "rspamd_task_write_log.*MX_INVALID" /var/log/mail.log*
> 

...

> I'm using a local recursing resolver on localhost (unbound) without
> any forwarders (querying the root NSs directly).
> 
> Still, I see quite a lot of MX_INVALID entries in my log, for domains
> with no (at least to me) obvious DNS issues. Are you numbers similar?
> 
> I already increased the timeout (a long time ago) om
> local.d/mx_check.conf
> 
> enabled = true;
> timeout = 10.0;
> 
> How would I debug this further? Is anybody making similar
> observations?
> 
> -- 
> Ralf Hildebrandt
> Charité - Universitätsmedizin Berlin
> Geschäftsbereich IT | Abteilung Netz | Netzwerk-Administration
> Invalidenstraße 120/121 | D-10115 Berlin
> 
> Tel. +49 30 450 570 155
> ralf.hildebrandt at charite.de
> https://www.charite.de

I have the same local.d/mx_check.conf as you and the same DNS as well.
I keep 31 logs and in my current set have no occurrences of that
symbol.  It's pretty uncommon that I see it.

Extract all the corrsponding SMTP From or HELO from your logs and run
them through a script to check 1) that there is an MX and 2) that the
MX is reachable.  Though that's only giving results at the time the
script runs, of course, not back in time when the symbol hit and got
logged.  Maybe that will shed a little light.