I just looked at the dates a little more closely. For runq to remove the mail the same day that it was delivered implies that it thought that the mail was successfully delivered (or that the clock on the file server is 3 days off). The fact that the message was removed without an accompanying smtp.fail message with the same timestamp implies that the smtp succeeded. However, there should have been a log entry in smtp should that have been true. Your original message shows: # # Looking /sys/log/smtp we can confirm these two mails have not been delivered # term% tail smtp ... term% I'm not sure what this means, but I'm assuming it means that there was nothing in the smtp log? This is all just a bit wierd. Have you changed the /mail/lib/remotemail script? It really looks like the script did not return an error code as if the smtp had succeeded. If there is inded nothing in /mail/lib/smtp, it sounds like either the remotemail script is broken or smtp is. Either way, I think you need to start debugging.