sendmail - sendmail using relay (Why it doesn't work?)

Question

I am trying to configure configure sendmail to use a relay. I've tried several procedures, but I don't know why it doesn't work since the same relay is used by other services and it works.

Below is the installation procedure I am using.

What can I do to diagnose what happens? What could be wrong?

Thanks!

Installation and configuration

Run the following to update and install...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create directory for storing authentication files...

mkdir /etc/mail/authinfo
chmod 700 /etc/mail/authinfo

Create a auth file...

TIP: The file may have any name like "smtp-auth".

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo/smtp-auth"

Create a hash map file of above created auth file...

enter code heremakemap hash /etc/mail/authinfo/smtp-auth < /etc/mail/authinfo/smtp-auth

Configure Sendmail with SMART_HOST...

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test and output

[root@localhost ~]# read -r -d '' EMAIL_CONTENT << 'HEREDOC'
> BEGIN
> From: my_user@my_domain.com.br
> To: recipient@recipient_domain.com
> Subject: Fail2ban test
> 
> Fail2ban test
> 
> END
> HEREDOC
[root@localhost ~]# echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
map_lookup(mailertable, recipient_app.com, %0=recipient_app.com) => NOT FOUND (0)
map_lookup(mailertable, .com, %0=.com, %1=recipient_app, %2=recipient_app) => NOT FOUND (0)
map_lookup(mailertable, ., %0=., %1=recipient_app.com) => NOT FOUND (0)
recipient@recipient_domain.com... Connecting to smtp.my_domain.com.br port 587 via relay...
220 a2-smithers5.uhserver.com ESMTP
>>> EHLO localhost.localdomain
250-a2-smithers5.uhserver.com
250-PIPELINING
250-SIZE 41943040
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN LOGIN PLAIN
250-AUTH=LOGIN PLAIN LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
map_lookup(macro, {TLS_Name}, %0={TLS_Name}, %1=smtp.my_domain.com.br) =>  (0)
map_lookup(access, TLS_Srv:smtp.my_domain.com.br, %0=TLS_Srv:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:my_domain.com.br, %0=TLS_Srv:my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:com.br, %0=TLS_Srv:com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:br, %0=TLS_Srv:br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36.31, %0=TLS_Srv:200.147.36.31) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36, %0=TLS_Srv:200.147.36) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147, %0=TLS_Srv:200.147) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200, %0=TLS_Srv:200) => NOT FOUND (0)
map_lookup(access, TLS_Srv:, %0=TLS_Srv:) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:smtp.my_domain.com.br, %0=AuthInfo:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:200.147.36.31, %0=AuthInfo:200.147.36.31) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:, %0=AuthInfo:) => "U:my_user@my_domain.com.br" "I:my_user@my_domain.com.br" "P:brlight2012" "M:PLAIN" (0)
>>> AUTH PLAIN YWRtaW5AbGlnaHRiYXNlLmNvbS5icgBhZG1pbkBsaWdodGJhc2UuY29tLmJyAGJybGlnaHQyMDEy
235 2.7.0 Authentication successful
>>> MAIL From:<[email protected]> SIZE=97 [email protected]
550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, MAILER-DAEMON, %0=MAILER-DAEMON) => NOT FOUND (0)
map_lookup(host, my_domain.com.br, %0=my_domain.com.br) => my_domain.com.br. (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
root... Connecting to local...
root... Sent
Closing connection to smtp.my_domain.com.br
>>> QUIT

NOTE: The "my_user@my_domain.com.br" account is able to send email to the "recipient@recipient_domain.com" account from its webmail.

ERROR: "550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english).

For debugging add -Amswitch to sendmail command line. [It requires root privileges but you execute it as root anyway]. Later you may add also -d60.5 to trace map lookups (it would include authinfo lookups). — AnFi onet.eu, Commented Jan 20, 2020 at 13:46
@AnFi The error "Connection refused by alt4.recipient-smtp-in.l.recipient_domain.com" is happening, but when the same email is sent from webmail, everything works. What may be missing? =/ — Eduardo Lucio, Commented Jan 20, 2020 at 14:06
@AnFi Using "-d60.5" other errors are observed ("NOT FOUND"). — Eduardo Lucio, Commented Jan 20, 2020 at 14:13
Your sendmail "does not see" smart-host configuration. FIX quotes in your mc file. m4 program expects `x' quotes. — AnFi onet.eu, Commented Jan 20, 2020 at 14:45
Add -f my_user@my_domain.com.br to sendmail command lines options. It will fix/change email address used in MAIL FROM:. It should be sufficient for testing. Proper (final) fix will require sender email address rewriting/masquerading. — AnFi onet.eu, Commented Jan 20, 2020 at 17:12

AnFi onet.eu · Accepted Answer · 2020-01-20 16:49:30Z

1

mc files expects `x' quotes [fixed in revised version of the question]
1. You have deployed standard recommendation to forbid sending "plain text" (unencrypted) password over unencrypted SMTP connections [p flag in confAUTH_OPTIONS].
2. Your smart host offers only plaintext authentication [see AUTH lines in EHLO reply] but it does not offer upgrading to encrypted connection [no STARTTLS in EHLO reply].
3. Effectively your configuration forbids to send unencrypted password over unencrypted SMTP connection but your smart host offers no other option.

answered Jan 20, 2020 at 16:49

AnFi onet.eu

1,5567 silver badges10 bronze badges

What kind of settings do I need to enable "encrypted password"?
– Eduardo Lucio
Commented Jan 20, 2020 at 17:05

Add a comment |

Eduardo Lucio · Accepted Answer · 2020-01-22 22:24:37Z

The error...

"550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english)

... happens because the SMTP service in use by us requires that the "envelope sender" be the same as the effective "sender".

To address this issue we need to build a genericstable database to map the input sender address to the desired address.

In our case, create the file "/etc/mail/genericstable" with the entry root my_user@my_domain.com.br and add the entry FEATURE(genericstable',hash -o /etc/mail/genericstable.db')dnl in the "/etc/mail/sendmail.mc" file.

For a better understanding, below is the complete procedure.

Sendmail - Installation and configuration

Run the following to update and install dependencies...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create an auth file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo"

Building a "genericstable" database to map the input sender address to the desired address ("envelope sender").

Create the "genericstable" file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
root           my_user@my_domain.com.br

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/genericstable"

Configure Sendmail with "SMART_HOST".

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl
FEATURE(`genericstable',`hash -o /etc/mail/genericstable.db')dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test your configuration

read -r -d '' EMAIL_CONTENT << 'HEREDOC'
BEGIN
From: my_user@my_domain.com.br
To: recipient@recipient_domain.com
Subject: Fail2ban test

Fail2ban test

END
HEREDOC
echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com

[Refs.: http://blog.achinthagunasekara.com/2015/08/how-to-configure-sendmail-to-work-with.html , https://access.redhat.com/discussions/2959431 , https://docs.cloud.oracle.com/iaas/Content/Email/Reference/sendmail.htm , https://serverfault.com/a/574118/276753 , https://serverfault.com/a/839476/276753 , https://superuser.com/a/1448009/195840 , https://tecadmin.net/sendmail-to-relay-emails-through-gmail-stmp/ , https://www.bonusbits.com/wiki/HowTo:Configure_SendMail_to_Use_SMTP_Relay , https://www.sitepoint.com/community/t/email-mx-records-vs-spf-records/7947 ]

Further question/Plus: Why use Sendmail with relay?

The biggest problem with sendmail is that a lot of spammers like to use it to blast out emails without needing a domain name, so it gets rejected frequently. If you have a SMTP you can relay through that will help matters a bit.

[Ref.: https://support.nagios.com/forum/viewtopic.php?f=7&t=28246 ]

Stack Exchange Network

sendmail - sendmail using relay (Why it doesn't work?)

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
email
sendmail
smtp
.

Hot Network Questions

sendmail - sendmail using relay (Why it doesn't work?)

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged emailsendmailsmtp.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
email
sendmail
smtp
.