Why Sophos UTM not sending emails out

I would assume that your ISP told you wrong.

1. Test DNS.   Can you do an MX Lookup on example.com using UTM as your recursive dns server?   Can you do a lookup on those mail server names and obtain an IP address.
2. Test with PING and TRACERT to see if you can get through the network to those devices.   No guarantee that they respond to ping, but I expect most of them will.
3. Test SMTP Connectivity.   Use the Microsoft Telnet client and try to "telnet mail.example.com 25".   If you do not get any response, you are getting blocked.   If you use Wireshark to monitor your test traffic, you may even see a reply packet that says "administratively blocked"

Of course, once you get connectivity solved, you have to get past the spam filters at the receiving end.   Have you updated your MX record in DNS?  Have you checked your domain and IP reputation using MXToolbox.com ?

Hey Douglas. Thanks for your response.

For 1, 2, 3 I've no issues. Already tested but have not tried wireshark yet.

For my external DNS has been updated. My mx record points to mail.mydomain.com.

If my ISP blocking port 25 I wouldn't be able to email out anything but some emails go through.

Any ideas what else could it be?

You mnetioned you could send to gmail, but not hotmail, 365 etc

When you did your test (without the UTM) did mail get to hotmail, 365 as opposed to when it's going via the UTM, it can't get to them?

When you IP changed did you delete and recreate the WAN interface or just edit it?

Yes email goes out directly from my mailenable mail server if using UTM it doesn't

Did not edit the WAN interface even. It's set to PPPoE and dynamically getting an IP from my ISP.

What I've done is I created a new interface using another physical card using PPPoE and same results. 

But

When I used WAN to be an ethernet hooked up to a 4G modem so different IP and connection obviously it did work. Any idea why UTM doesn't like my normal VDSL connection when sending out emails where sending without UTM is fine. 

Obviously, you are at the point that you need someone to lay eyes on your configuration.   

Since you are running a mail server, I am assuming that you are not a home user.   Do you have access to support?

My configuration is correct as it was working before and it did work when I switched to 4G interface.

For now I'm going to try Sophos XG and see what it has got for mail protection as well as web. Do you recommend it?

Just a comment here (and not pointing the finger at the actual issue) but I would imagine you would have issues with sending mail from a mail server via 4G. I'm not aware of any providers who actually give out static IP's on 4G networks (in the UK at least). Mail servers coming from dynamic IP ranges will suffer from connectivity issues with regards to mail.

You may also be suffering from the reputation of the IP address you are sending from and this may need built up over time. you can check here:

https://www.senderscore.org/

Let me rephrase. My VDSL connection which has static IP is having the issue with sending out emails. When I connect my 4G test router to Sophos through ethernet emails go out. I'm talking about outgoing not incoming emails.

If I don't relay on Sophos and send out from my mail server directly emails go out fine (on VDSL connection).

I'm not relaying to Sophos now and will give it some time for reputation to build up on new IP address then will try relaying to Sophos. I guess that's my only option. 

There has to be a configuration error.   The timeout indicates a delivery problem, not a traffic rejection problem.   The delivery problem implies a routing problem or a traffic filter.   If it was a rejection problem, the sending hardware would not matter.

Does UTM connect directly to the Internet, or is there a home router in the configuration?   If you have another firewall, maybe there is a configuration problem on it.

Reboot your UTM.  That step has fixed a variety of strange unexplained problems for other users in this forum.

Check all of your SNAT/NAT/DNAT rules, there may be one that was not updated for the new IP address.

Disable Country Blocking, to see if that has an effect.

Check ALL (30 or so) of your UTM logs, looking for clues.

No router or firewall before UTM other than a modem which is on bridged mode. Firewall is disabled on it though. Modem firmware is on latest. UTM is on latest firmware. UTM is virtualized on Hyper-V. 

I've couple of DNAT rules for my plex and my RDS portal. 

In my firewall currently I'm allowing any to any and putting rule in top. Country filtering isn't configured.

What UTM logs to check other than mail logs? As you can see I've done two tests, one is sending to my work email and one to my personal email.

To my work email which went through:

Then from mail manager I retried to send email then I get this:

No router or firewall before UTM other than a modem which is on bridged mode. Firewall is disabled on it though. Modem firmware is on latest. UTM is on latest firmware. UTM is virtualized on Hyper-V. 

I've couple of DNAT rules for my plex and my RDS portal. 

In my firewall currently I'm allowing any to any and putting rule in top. Country filtering isn't configured.

What UTM logs to check other than mail logs? As you can see I've done two tests, one is sending to my work email and one to my personal email.

To my work email which went through:

Then from mail manager I retried to send email then I get this:

I've rebooted UTM already multiply times. Even restored previous back of previous UTM version thinking it's something to do with latest firmware which got released few days ago.

I de configured mail protection fully and reconfigured it.

Nothing worked.

Ok,

in the last 2 tabs of the mail setup - relaying & advanced, is there anything special in there?

Under relaying - try turning off "scan outgoing messages" and see what happens.

I'm still not convinced that the issue lies there though due to some mail getting through.

in the routing tab nothing configured other than allowed hosts relay which is my mail server.

In advanced tab nothing configured and I'm using TLS v1 or higher

Unticking scan outgoing emails did not make any difference.

I'm on simple mode email protection.