2

I am having this trouble with our mail server (postfix):

I try to send a test mail using mail command and it runs ok:

mail mailamilmail@gmail.com
Subject: bla
bla (CTRL+D) 

But when I look to tail -f in /var/log/mail.log, I have a connection timed out on port 25.

connect to gmail-smtp-in.l.google.com[64.233.190.26]:25: Connection timed out

I discovered that port 25 is blocked in Brazil ISPs, so my question is: Can I change the port that postfix are trying to communicate with other servers or this is a default mandatory port for servers communication?

1

Port 25 is the standard port that is used over the internet for SMTP communication. If you wish to talk to someone else then it will be over port 25.

You can use alternate ports internal to your own network; eg if you have an Amazon server you could configure it to use port 2525 and configure your local machine to talk to that port. But talking to anyone else (eg Google, as in your example) must be on port 25.

You may find your ISP has a relay server that you can use (maybe with authentication). This is typically how ISPs try to stop letting people spam out; if you can't talk to the internet on port 25 and must go through their relay then they can rate limit, spam filter, etc.

Another solution, if you have an external server (eg Amazon) would be to configure a VPN between your machines; that'll bypass the ISP port 25 restrictions.

1
  • The solution was to call the ISP/provider and request the opening of the port. – Luciano Andress Martini Jul 6 '16 at 18:39
3

Some ISPs and organisations have been blocking port 25/TCP to try to control spam relays for more than a decade now.

One of the obvious alternatives is hosting your private domain in an international mail server company that offers your service in alternate email ports to port 25, for instance Google/Gmail.

As @Stephen also correctly managed to point out before me, another alternative is using a VM somewhere else. Or having a partnership with some branch/exchanging services with a related institution outside Brazil.

Many commercial email services offer additional ports for their users, and there are also other commercial services to redirect email messages for a relatively small fee.

The latter option should be probably less costly than running a VM on the cloud, but can have security implications. As an example, SMTP Port - Port 25 block redirection service (I do not know them, just a random google example)

Another alternative is contracting the services of a commercial VPN, and sending the email through them. Again, the security implications of tunnelling your traffic through them are something to think about, and your SPF for instance, might have to be more relaxed or include their netblocks.

Google is no exception to having alternate ports to send email; one of the alternative "official" ports is often 587/TCP.

This table was the best I could come up with that documents their offerings and alternatives.

Google Apps SMTP settings to send mail from a printer, scanner, or app

So:

  • using smtp-relay.gmail.com

    • the IP address has to be registered with google;
    • Port 25, 465, or 587 SSL/TLS optional;
    • You have to have Google Apps, for businesses it has a cost, for Education it is free.
  • smtp.gmail.com

    • to be used by each user;
    • Port 465 (SSL required) or Port 587 (TLS required);
    • any gmail account can authenticate and send up to 2000 emails per day.

The best option seems to be, if using Google, to have a Google Apps/domain with Google and configuring postfix to relay email via smtp-relay.gmail.com using port 465/TCP or 587/TCP as an alternative.

So to configure postfix for that, you have to add to your /etc/postfix/main.cf

relayhost = [smtp-relay.gmail.com]:587

I also remember I had to add to the Google apps domain admin interface the IP of the email server. Cannot remember at all where, it was not hard to find.

I would not also discount talking with your ISP to see if they:

  • are offering a relay service for people on your situation, to configure in postfix;
  • sell you a static IP address for a fee not subject to port 25/STMP control;
  • and/or if they have higher tiers of services not subject to port 25/STMP filtering.

Their interest is in curbing zombies spewing spam, not preventing you from sending email.

Often the lower tiers/residential netblocks are blocked as a standard security practice, however the netblocks used by enterprise tiers are not subject to that blockade. (this is a first hand information, I also ran at a time an ISP in a Portuguese speaking country)

1
  • So if google offer that how can i change my server to use 587 and not 25? – Luciano Andress Martini Jul 6 '16 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.