How to interpret detailed error logs from Postfix or Exim?

You've got a pile of log lines scrolling past and somewhere in there is the answer to why that message never arrived. Good news: once you know what to look for, Postfix and Exim logs are actually pretty readable. Let's walk through the patterns that matter.

Reading Postfix logs

Every Postfix log entry ties to a queue ID, a short alphanumeric string like 3F2A8421B9. That ID follows the message from the moment it's accepted to the moment it's delivered, deferred, or bounced. Find the ID for the message you care about, then filter every line containing it. That's your full story.

The field you want first is status=. Here's what each value means in practice:

• status=sent means delivery succeeded. You'll also see relay= showing the destination server and dsn=2.0.0 confirming it.
• status=deferred means a temporary failure. Postfix will retry. Common causes: the receiving server was busy, rate-limiting kicked in, or a DNS lookup timed out. The relay= and the error text after it will tell you which server pushed back and why.
• status=bounced means permanent failure. The message is gone and won't retry. Read the full error text here carefully. It often includes the destination server's actual rejection message, which is where you'll find the real reason (reputation block, full mailbox, address doesn't exist).

A real deferred line might look something like this:

postfix/smtp[1234]: 3F2A8421B9: to=<crew@deepcurrent.io>, relay=mail.deepcurrent.io[93.184.216.34]:25, delay=4.2, status=deferred (host mail.deepcurrent.io said: 421 Too many connections from your IP)

That 421 code tells you the receiving server is throttling you. It's not a block, it's a slow-down. You'd want to check your sending rate or look at whether your IP is on a connection throttling list.

Reading Exim logs

Exim uses a message ID in a different format (like 1qABCD-000EFG-HI) and a set of directional symbols instead of a status field:

• <= means the message was received by your server.
• => means a delivery attempt was made.
• ** (two asterisks) means the delivery failed permanently.
• == means delivery was deferred temporarily.

Trace the message ID across all four symbols and you've got the full lifecycle. The deferred and failed lines will include T=remote_smtp (transport used) and the error text from the destination server.

An Exim failure entry looks roughly like this:

2024-03-15 09:14:22 1qABCD-000EFG-HI ** harbor@lighthouse.net T=remote_smtp: SMTP error from remote mail server after end of data: 550 5.7.1 Message rejected due to content policy

That 550 5.7.1 is a permanent content rejection. The destination server didn't like something in the message itself, which is a different problem from a reputation issue or a bad address.

The correlation approach that actually works

Whether you're in Postfix or Exim, the method is the same. Find the message ID for the problem email (usually from your application logs or a complaint). Then run something like grep "MESSAGE_ID" /var/log/mail.log to pull every log line attached to that message. Read them top to bottom. You're looking for where the flow stops or changes direction, that's where the problem lives.

Pay attention to the SMTP response codes in the error text. The dsn= field in Postfix (or the inline SMTP code in Exim) is your best clue. 4xx codes are temporary, 5xx codes are permanent. The second and third digits narrow it down further (5.1.1 is usually unknown user, 5.7.1 is usually a policy or reputation rejection).

If the logs aren't giving you enough context, running the Email Header Analyzer on a test message can show you what the receiving end saw, which is often more informative than what your sending server recorded.

And if you're staring at a log line that makes no sense, our SOS hotline is free. Paste the line in and we'll help you decode it.