Learn Mailserver - Monitoring, Logging & Deliverability
Listening to the mail server's heartbeat: reading /var/log/mail.log, summarizing statistics with pflogsumm, monitoring the queue with mailq, tracing Dovecot performance via doveadm stats, and maintaining deliverability scores via mail-tester, feedback loops, warm-up, and blacklist monitoring.
#Introduction
All the features are complete and the fortress is locked. But a healthy mail server is a server that's listened to. This episode teaches the language of logs and numbers: reading mail.log, summarizing statistics, monitoring the queue, and maintaining deliverability so your email doesn't drown in the spam folder.
We'll use pflogsumm for daily summaries, mailq for the queue, doveadm stats for performance, then close with deliverability strategy: mail-tester, provider feedback loops, domain warm-up, and blacklist monitoring.
#The Main Log: /var/log/mail.log
On Debian/Ubuntu, all mail logs are collected in /var/log/mail.log (hard errors in mail.err). Each line is the trace of an event — here are the patterns you'll read most often:
sudo tail -f /var/log/mail.log
sudo grep "status=" /var/log/mail.log | grep -v "status=sent"The second line shows all email that wasn't sent — the starting point for finding problems. The status patterns you need to know:
| Status | Meaning |
|---|---|
status=sent | Delivered (or handed to the next server) |
status=deferred | Delayed; retried later (check the reason in the reason= message) |
status=bounced | Permanently failed; the message is returned |
status=expired | Failed after the retry time limit; the queue discards the message |
The habit of grep "status=deferred" each morning catches problems before they pile up.
#Summarizing with pflogsumm
pflogsumm turns thousands of log lines into a one-page summary. Install and run it daily:
sudo apt install -y pflogsumm
pflogsumm /var/log/mail.logThe summary shows how many emails were received, sent, bounced, and bounce statistics per destination. Schedule the daily summary to be emailed to you:
0 7 * * * pflogsumm -d yesterday /var/log/mail.log | mail -s "Mail summary" admin@example.compflogsumm -d yesterday limits the summary's range to yesterday — the right numbers for daily decisions.
#Monitoring the Queue
The queue is Postfix's pulse. Three mandatory commands:
mailq
postqueue -p
postqueue -p | grep -c "^[0-9A-F]"The third line counts the messages in the queue. A queue that keeps growing (deferred) indicates a problem with a destination server or relay. See the delay reasons:
postqueue -p | grep -A1 "deferred" | head -20To clean a stuck queue: postsuper -d deletes, postsuper -r requeues, and postfix flush forces an immediate attempt.
#Dovecot Performance with doveadm stats
Dovecot has its own statistics system. Enable and read:
doveadm stats reset
doveadm stats dumpdoveadm stats dump shows IMAP sessions, auth processes, and I/O load. For continuous monitoring, integrate with Prometheus + node_exporter:
curl -s localhost:9100/metrics | grep mailIf node_exporter runs with the mail plugin, metrics like queue size and Postfix process statistics are available. This is the standard 2026 monitoring pattern.
#Deliverability: What the World Says
Deliverability isn't measured from your server, but from mailbox providers. Two mandatory tools:
- mail-tester.com — send a test email and get a 1-10 score with per-component detail (SPF, DKIM, DMARC, blacklist, rDNS).
- Google Postmaster Tools — once volume is sufficient, shows domain reputation, spam rate, and Gmail's feedback loop.
swaks --server mail.example.com --port 587 --tls \
--auth-user admin@example.com --auth-password 'rahasia' \
--to tes@mail-tester.comGo back to mail-tester and look at the score. Fix the components highlighted in red — usually PTR, SPF, or DKIM that isn't quite right.
#Feedback Loops, Warm-up, and Blacklists
Three practices that keep reputation high:
- Feedback loop (FBL) — register the domain in provider FBL programs (Gmail, Outlook, Yahoo) to receive reports when users mark your email as spam. A high FBL rate is a red alarm.
- Domain warm-up — don't immediately send thousands of emails from a new domain. Ramp up volume gradually over 2-6 weeks so reputation can build.
- Blacklist monitoring — regularly check whether your IP/domain appears on lists like Spamhaus or Barracuda:
dig +short 2.0.0.127.zen.spamhaus.orgdig +short 2.0.0.127.zen.spamhaus.org maps the IP to reversed notation for the Zen query — a non-empty answer means the IP is listed.
Tip
Build the "one email story" habit: when a report of undelivered email comes in, trace one sample email from mailq, mail.log, the Received: headers, to the blacklist query results. Solving one case teaches more than 10 articles.
#Conclusion
Episode 19 is done. Key takeaways:
mail.logis the diagnostic center; know the meaning ofsent,deferred,bounced, andexpired.pflogsummsummarizes logs into an easy-to-read daily report.mailqandpostqueue -pmonitor the queue;doveadm statsmonitors IMAP performance.- mail-tester scores and feedback loops are the deliverability mirror from the recipient's point of view.
- Domain warm-up and blacklist monitoring maintain long-term reputation.
Your server can now talk about itself. In episode 20 we polish the webmail: Roundcube Advanced — Plugins & Multi-Auth — password changes, Sieve filters, OpenPGP, and OAuth2/OIDC login. See you in episode 20!