I had a perfectly working Postfix server for a long time and made the mistake of changing something without backing up my main.cf first. I’ve occasionally received emails that spoofed my own domain, so I attempted to follow the instructions here to prevent it.
Because I had followed the guide on flurdy.com, SASL authenticated submission on 587 was already enabled, so I made no changes to master.cf.
After setting up check_sender_access as described above, I could no longer receive emails from outside domains. I attempted to undo everything, but it’s still broken, and I’ve almost certainly made things worse trying to fix it. I even went as far as starting fresh on another machine and going through the guide again, but eventually reverted back to my old server.
smtp/smtpd connections to/from external servers still show up in my log, but I just get timeouts and SSL/TLS errors.
Oct 6 11:28:23 ns1 postfix/smtp[8191]: SSL_connect error to mta6.am0.yahoodns.net[98.136.96.91]:25: Connection timed out Oct 6 11:28:23 ns1 postfix/smtp[8191]: 30E9C65FD2: Cannot start TLS: handshake failure
Oct 6 11:38:46 ns1 postfix/smtpd[8214]: SSL_accept error from mail-lj1-f173.google.com[209.85.208.173]: Connection timed out Oct 6 11:38:46 ns1 postfix/smtpd[8214]: lost connection after STARTTLS from mail-lj1-f173.google.com[209.85.208.173]
I am, however, still able to send/receive email between my two domains hosted on this server. I’m at my wit’s end. Please help!
What happens if you use Python to manually connect to your sever using the smtp library.
Or, can you try to manually connect using openssl?
In other words if you manually connect to the smtp server and issue the starttls command do you have issues?
If you need help doing this let me know I can provide some links for how to do this.
Also, did you make any firewall changes or modify the cert file in anyway?
Two last things: the link doesn’t seems to show configs. Please help me find those and it looks like 465 is open on your machine. Does that port work still?
I’m able to send and receive between my own domains, so STARTTLS is working fine there. Below is testing using openssl from another machine. My main.cf and master.cf are in the first post. Which other configs did you need?
I tried temporarily removing defer_unauth_destination just to see if it made a difference. Sent myself another test message from gmail and it still showed as connecting and then timed out.
mydestination is blank in main.cf because I’m using virtual domains.
inet_interfaces = all to accept connections from anywhere
proxy_interfaces hasn’t ever been in my config and the default is empty.
virtual_alias_domains is defined within virtual_alias_maps
I turned up smtpd_tls_loglevel to 2 and noted the following:
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: setting up TLS connection from mail-vs1-f74.google.com[209.85.217.74]
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: mail-vs1-f74.google.com[209.85.217.74]: TLS cipher list "aNULL:-aNULL:HIGH:@STRENGTH"
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:before SSL initialization
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:before SSL initialization
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:SSLv3/TLS read client hello
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:SSLv3/TLS write server hello
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:SSLv3/TLS write change cipher spec
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:TLSv1.3 write encrypted extensions
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:SSLv3/TLS write certificate
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:TLSv1.3 write server certificate verify
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:SSLv3/TLS write finished
Oct 7 22:22:06 ns1 postfix/smtpd[5401]: SSL_accept:TLSv1.3 early data
...
Oct 7 22:27:06 ns1 postfix/smtpd[5401]: SSL_accept error from mail-vs1-f74.google.com[209.85.217.74]: Connection timed out
Oct 7 22:27:06 ns1 postfix/smtpd[5401]: lost connection after STARTTLS from mail-vs1-f74.google.com[209.85.217.74]
Oct 7 22:27:06 ns1 postfix/smtpd[5401]: disconnect from mail-vs1-f74.google.com[209.85.217.74] ehlo=1 starttls=0/1 commands=1/2
...
Oct 7 22:46:46 ns1 postfix/smtp[5785]: initializing the client-side TLS engine
Oct 7 22:47:16 ns1 postfix/smtp[5785]: connect to mta7.am0.yahoodns.net[67.195.228.110]:25: Connection timed out
Oct 7 22:47:46 ns1 postfix/smtp[5785]: connect to mta5.am0.yahoodns.net[98.136.96.91]:25: Connection timed out
Oct 7 22:48:16 ns1 postfix/smtp[5785]: connect to mta6.am0.yahoodns.net[67.195.204.79]:25: Connection timed out
Oct 7 22:53:17 ns1 postfix/smtp[5785]: A50486279F: conversation with mta5.am0.yahoodns.net[67.195.228.111] timed out while receiving the STARTTLS response
Oct 7 22:53:17 ns1 postfix/smtp[5785]: setting up TLS connection to mta7.am0.yahoodns.net[98.136.96.76]:25
Oct 7 22:53:17 ns1 postfix/smtp[5785]: mta7.am0.yahoodns.net[98.136.96.76]:25: TLS cipher list "aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH"
Oct 7 22:53:17 ns1 postfix/smtp[5785]: SSL_connect:before SSL initialization
Oct 7 22:53:17 ns1 postfix/smtp[5785]: SSL_connect:SSLv3/TLS write client hello
I did a completely fresh setup on a different machine and updated my firewall rules to point to the new server. Same result. I’m at the point where I now think AT&T just randomly blocked outbound traffic on port 25 for my connection. I’ve talked to a few clueless tier 1 and 2 support people and finally got someone who seems to be trying to escalate the issue to even verify that that’s what is happening. At first, he tried to tell me that “We don’t unblock port 25 because of spam.” I told him that was unacceptable and particularly frustrating because I received no notice of any potential change, and I’ve spent an enormous amount of time troubleshooting the issue on my end. I should be getting a call back soon. Fingers crossed. I sure as shit don’t want to have to resort to relaying my smtp traffic through AT&T’s mail server. Fuck that noise.
By the way, huge thanks to @cotton and @nx2l for even attempting to help me sort this out. I honestly expected this thread to sink like a stone.
Update: I looked at the Suricata logs on my firewall and realized that right around the time I stopped receiving email, there started to be a flood of ‘1:2260002 SURICATA Applayer Detect protocol only one direction’ alerts from my mail server on port 25 which resulted in whatever external mail server it was communicating with at the time to be blocked. I suppressed the rule and cleared the block list, and I’m receiving mail again. Still, it’s disconcerting that this started happening all of a sudden.