Postfix: How to keep an email in the mail queue for further investigation?

Solution 1:

The HOLD feature should be sufficient for what you ask for, either use it on a message that is not yet delivered:

postsuper -h QUEUEID

Since you cannot know the queue ID in advance and might not be able to see it in the time between postfix queuing the mail and final delivery, I recommend defining the criteria for which messages to hold in advance.

Most smtpd_*_restrictions allow providing a map that can automatically mark certain mails for holding. Sample:

# in main.cf
smtpd_client_restrictions = [..]
    reject_unknown_reverse_client_hostname
    [..]
    check_reverse_client_hostname_access hash:/etc/postfix/badrdns permit

# in /etc/postfix/badrdns
.subdomains.example.com            HOLD one of these is not a spammer

Release or drop mails from the queue after investigating.

postqueue -p
# view a message from queue
postcat -qbhe QUEUEID | less

# deliver previously held
postsuper -H QUEUEID
# drop (DELETE!) a message
postsuoer -d QUEUEID

Do not forget to remove the HOLD rule when done (or you accumulate a giant queue).