[Solved] Please help. "1 subscriptions exceed limits". How come? And how to restore/repair?

[vvenet]

Dear support team,

In Plesk, I have this warning text on top of every individual e-mail that has been setup in my account:
"Warning: The limit on outgoing messages for an email address (10) cannot be greater than the limit for a subscription (0)."

I did try to figure out what this means and how to resolve it myself. The more in researched this, the stranger it became. Maybe there is a fault in Plesk's configuration?

When I go to Plesk' 'Outgoing Mail Control'', I see this overview:
Email addresses: No attempts to exceed limits
Domains             : No attempts to exceed limits
Subscriptions     :  1 subscriptions exceed limits

To my astonishment, my vvenet.heliohost.us has the following reading: 
Limit per hour: 0
Attempts after Reaching the Limit: 4767 
Last attempt: Oct 2, 2024, 02.00PM
Mail Status: Sending
 

When I zoom in this by checking Outgoing Mail Control of vvenet.heliohost.us, I discover that Attempts after Reaching the Limit over a one month period are 3113 and that it started on September 30.
The strange thing is that I am not sending e-mail from vvenet.heliohost.us.

Furthermore, I have no idea what & why this is happening.
I assume that there is a setup fault at Plesk. 

Can you please investigate and restore my 'subscription' ? 
Kind regards

[wolstech]

Limit of zero on your subscription means that you’ve lost your right to send email because you sent too many.

If it says you tried to send 3000+ emails, that’s why. Something on your account is attempting to spew email. Common causes are a script like a contact form being abused by bots, an email address with a forwarder that’s receiving tons of email (forwarded mail counts as sent mail), or a mailbox with a compromised password.

I can try to research it a bit more when I’m at a computer later.

[vvenet]

Dear @wolstech, thank you for your reply.
I have no idea were this is coming from.
When I look at https://heliohost.org/dashboard/load/, my load is almost nothing.

I find it so strange it is only coming from the the main account name vvenet.heliohost.us and not from the other domains + emails that are in the main account.

Also when I look at the webmail of vvenet.heliohost.us, there is no e-mail there (not incoming or outgoing e-mail). 
I have no contact forms and I have strong passwords.

I appreciate if you can look into this. I would not know where to start since I can also not see the origin of these send-out e-mails and where they are send to.
 

[UPDATE] Just to be on the safe side, I have disabled the catch-all forward feature for non-existent mail addresses ( like anything@domain.xyz).

Kind regards,

Edited October 2 by vvenet
update

[wolstech]

48 minutes ago, vvenet said:

I find it so strange it is only coming from the the main account name vvenet.heliohost.us and not from the other domains + emails that are in the main account.
 

] Just to be on the safe side, I have disabled the catch-all forward feature for non-existent mail addresses ( like anything@domain.xyz).

 

In Plesk, the "subscription" (your allocation of resources) is named after your main domain. All domains a user has share the same subscription in our system. As a result, any of those domains could be sending the messages and they will still show as your main domain since the mail is allocated to the subscription named after your main domain.

I'm looking at the mail queue, and you're receiving a ton of spam to mail@hcdirven, which is then forwarding and making it look like you're sending spam.

Mail forwarding is a surefire way to get blocked for sending too many emails. Catch-all forward is even worse because literally every email to your domain forwards even if they don't know the mailbox address. I'd be willing to bet those 9 mailboxes forwarded to a dummy gmail account aren't helping things here either.

All of these forwarders need to go.

Do you want me to remove all of your mail forwarders and reactivate your mail service (mail will deliver to the mailbox on Plesk, be aware you may run out of disk space if you're receiving tons of mail)?

Or would you prefer to disable inbound mail so all mail sent to your domains rejects instead (it kind of looks like the forwarders were meant to do that anyway...)?

[vvenet]

Dear Wolstech, thank you for your reply and info. It is highly appreciated.

The gmail account you are referring to is not a dummy account (despite its name). Please trust me on that. 
And I never receive tons of e-mail. And all e-mail settings on Pleask worked fine untill one week agon. 

Regarding your two proposals: please neither of them. Because I have solved the issue myself now I think. Let me please explain.
 
I also noticed that since one week, I received an incredible amount of spam. I found out myself it was due to the catch-all feature on the domains in my account. Since two hours now I have disabled all the catch-all features on all domains in my account. It was all forwarded to mail@hcdirven.nl, so that is why they were in cue for that e-mail address. Since that moment I have disabled the catch all feature (two hours ago), all spam has stopped (so also no forwards anymore to mail@hcdirven.nl). All these e-mails tot non-existing adsresses are now rejected. You can check it yourself in Plesk: all email send to "Mail sent to non-existent users" is now rejected.

For your information: the reason I use mail forward to Gmail is actually to relief Heliohost systems for not taking too much storage on your platform/network.

So my kind request is
1) to leave the e-mail settings as they are right now and
2) to enable my subscription since all has returned to normal now.

Lesson learned.  🙂
Thank you for your support and understanding. Kindly awaiting your reply. 
 

[wolstech]

I'll turn the mail service back on and we'll see how it goes. If it happens again, you're going to need to find another solution.

Mail service has been restored for your account.

[vvenet]

Dear @wolstech, thank you again for your kind understanding and support. 🙂

[vvenet]

12 hours ago, vvenet said:

Dear @wolstech, thank you again for your kind understanding and support. 🙂

[UPDATE]

Dear @wolstech, just to inform you, please see attached graphic. From the moment the catch-all feature had been disabled around 19.00 hour, all returned back to normal proportions instantly.

Thank you again for your kind understanding and support! 🙂 

One final question in this regard. At the Outgoing Mail Control page, there is still this warning message I: “1 subscriptions exceed limits”. What is the time period this warning message will reset itself automatically?

Edited October 3 by vvenet
Added final question.

[wolstech]

I'm not sure honestly, but my guess is 24 hours (basically once all the red disappears), assuming you don't have any new hours during that time where the limit gets exceeded.