but this entry is exactly two hours later from the first entry from policyd.
Do you think that two hours to come out from graylist is a normal time? Can it depends on sender SMTP server?

Which distribution do you use?

If you use RHEL/CentOS, there's a bug in syslog, and the timestamp in log file maybe incorrect. Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=193184

Maybe we should forget the timestamp in log files, just check whether mails were delivered correctly.

Check /var/log/sieve.log.
Mails sent to virtual users are all delivered by 'deliver' program which shipped within dovecot.

In the last few days many users are opening tickets because it seems they don't receive mail from specific senders. I asked for sender addresses and looked for them into maillog. And I noticed something very strange.

This is what happens for every mail that the user claim to be unreceived: the message seems to be delivered since the last entry reports "status=sent (delivered via dovecot service)", but this entry is exactly two hours later from the first entry from policyd.

An example:

Sep 16 09:25:51 mail postfix/smtpd[32563]: 4281798003F6: client=mail.domain.it[127.0.0.1]
...
Sep 16 11:25:51 mail postfix/pipe[32566]: 4281798003F6: to=<user@domain.it>, relay=dovecot, delay=0.03, delays=0.01/0.01/0/0.01, dsn=2.0.0, status=sent (delivered via dovecot service)
Sep 16 11:25:51 mail postfix/qmgr[24049]: 4281798003F6: removed

Do you think that two hours to come out from graylist is a normal time? Can it depends on sender SMTP server?

But over all: where are these messages? There is no trace of them into the user mailbox... :-S

What to check?

Thanks in advance!