Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 29 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 18821 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Why Sophos UTM not sending emails out

Mohamed Hassan

Hello Guys. Few days ago I had an issue with my internet resulted in changing my static IP. No since I've received a new IP I've updated my external DNS. 

However since my IP has changed I no longer able to send out emails from my UTM. I have mailenable which is relaying to UTM. From logs I can see UTM accepts relaying from my mailenable server but emails get spooled and see this in the logs:

 

2019:02:28-22:14:00 sukafun-utm smtpd[5343]: MASTER[5343]: Action: Forcing delivery process for 1gzMQI-000BCR-0t
2019:02:28-22:15:00 sukafun-utm exim-out[43216]: 2019-02-28 22:15:00 Start queue run: pid=43216
2019:02:28-22:16:19 sukafun-utm exim-out[41492]: 2019-02-28 22:16:19 1gzJxs-0007Mg-Dl SSL_write: (from [192.168.7.77]:999) syscall: Connection timed out
2019:02:28-22:16:19 sukafun-utm exim-out[41492]: 2019-02-28 22:16:19 1gzJxs-0007Mg-Dl SSL_write error 5
2019:02:28-22:16:19 sukafun-utm exim-out[41492]: 2019-02-28 22:16:19 1gzJxs-0007Mg-Dl SMTP timeout while connected to mail-tester.com [94.23.206.89] after sending data block (25910 bytes written): Connection timed out
2019:02:28-22:16:19 sukafun-utm exim-out[41491]: 2019-02-28 22:16:19 1gzJxs-0007Mg-Dl == test-3tjbp@mail-tester.com R=dnslookup T=remote_smtp defer (110): Connection timed out: SMTP timeout while connected to mail-tester.com [94.23.206.89] after sending data block (25910 bytes written)
2019:02:28-22:16:20 sukafun-utm exim-out[43418]: 2019-02-28 22:16:20 1gzKXM-0008JN-HK == test-37cxi@mail-tester.com R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2019:02:28-22:16:20 sukafun-utm exim-out[43422]: 2019-02-28 22:16:20 1gzKP8-00083Z-Gr == test-37cxi@mail-tester.com R=dnslookup T=remote_smtp defer (-53): retry time not reached for any host
2019:02:28-22:16:20 sukafun-utm exim-out[40075]: 2019-02-28 22:16:20 End queue run: pid=40075
 
 
It lets me send emails out to some domains like gmail but most of other domains not. I confirm that my ISP not blocking port 25. My UTM is connected to internet. My external DNS is correct. Tried enabling smarthost from UTM but same issue. What else should I look for? 
I receive emails fine.
 
 
Cheers
Mo


This thread was automatically locked due to age.
  • 0

    I would assume that your ISP told you wrong.

    1. Test DNS.   Can you do an MX Lookup on example.com using UTM as your recursive dns server?   Can you do a lookup on those mail server names and obtain an IP address.
    2. Test with PING and TRACERT to see if you can get through the network to those devices.   No guarantee that they respond to ping, but I expect most of them will.
    3. Test SMTP Connectivity.   Use the Microsoft Telnet client and try to "telnet mail.example.com 25".   If you do not get any response, you are getting blocked.   If you use Wireshark to monitor your test traffic, you may even see a reply packet that says "administratively blocked"

    Of course, once you get connectivity solved, you have to get past the spam filters at the receiving end.   Have you updated your MX record in DNS?  Have you checked your domain and IP reputation using MXToolbox.com ?

  • 0 in reply to DouglasFoster

    Hey Douglas. Thanks for your response.

    For 1, 2, 3 I've no issues. Already tested but have not tried wireshark yet.

    For my external DNS has been updated. My mx record points to mail.mydomain.com.

    If my ISP blocking port 25 I wouldn't be able to email out anything but some emails go through.

     

    Any ideas what else could it be?

  • 0 in reply to Mohamed Hassan

    As Douglas says, go to mxtoolbox.com and check there.

    A couple of things to also be aware of when changing IP address is:

    1. Has the rDNS record been updated with the ISP as this can sometimes result in mail being bounced. Check this with mxtoolbox.
    2. Have you got a true static IP and not a long lease from a dynamic range as this can cause mail to bounce also.

  • 0 in reply to Louis-M

    My rDNS points to my ISP as I'm not on a business plan however it was working before with my previous static IP still reverse DNS points to my ISP.

    My IP doesn't change. It has changed because I asked my ISP to reset my connection to resolve the internet issue.

     

    mxtoolbox resolves correctly to my new IP.

  • 0 in reply to Louis-M

    If th UTM is accepting the mail and spooling it, that suggests an issue with the outgoing. If some of it is going and some isn't, that elimates connectivity to the internet.

    Are your SPF records ok?

  • 0 in reply to Louis-M

    SPF is correct including new IP and syntax is correct.

    I've flush DNS from UTM.

    Checked that I'm not blacklisted.

     

    Nothing has changed other than updated my UTM which I don't think it's the issue and internet connection reset. Ran out of ideas :(

  • 0 in reply to Mohamed Hassan

    So, from the start:

    1. Your internal mail server sends to the UTM

    2. Some of that mail gets spooled on the UTM as the UTM is unable to send on the new external IP address?

  • 0 in reply to Louis-M

    That's correct. My UTM accepts email from my mail server no issues. I can send to gmail and my work domain as an example where I can't send to hotmail or office365 and other domains. Really strange one.

  • 0 in reply to Mohamed Hassan

    Just the same, "Connection timeout" means that the reply packet is not coming in.  You either have a routing problem or a packet drop problem.   Both are related to the mistakes made by your ISP.

    Did you update your default gateway in UTM when you changed IP?   If you have an internal router that transmits through UTM transparently, it's default gateway needs to be updated as well.

  • 0 in reply to DouglasFoster

    I'm getting an IP dynamically from my ISP as well as GW.

    My UTM is facing the internet behind a bridged modem.

    If you think it's a routing or ISP issue why don't emails go out when I use a public or my ISP smtp?

Unfiltered HTML