0

I am trying to configure configure sendmail to use a relay. I've tried several procedures, but I don't know why it doesn't work since the same relay is used by other services and it works.

Below is the installation procedure I am using.

What can I do to diagnose what happens? What could be wrong?

Thanks!


Installation and configuration

Run the following to update and install...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create directory for storing authentication files...

mkdir /etc/mail/authinfo
chmod 700 /etc/mail/authinfo

Create a auth file...

TIP: The file may have any name like "smtp-auth".

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo/smtp-auth"

Create a hash map file of above created auth file...

enter code heremakemap hash /etc/mail/authinfo/smtp-auth < /etc/mail/authinfo/smtp-auth

Configure Sendmail with SMART_HOST...

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test and output

[root@localhost ~]# read -r -d '' EMAIL_CONTENT << 'HEREDOC'
> BEGIN
> From: my_user@my_domain.com.br
> To: recipient@recipient_domain.com
> Subject: Fail2ban test
> 
> Fail2ban test
> 
> END
> HEREDOC
[root@localhost ~]# echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
map_lookup(mailertable, recipient_app.com, %0=recipient_app.com) => NOT FOUND (0)
map_lookup(mailertable, .com, %0=.com, %1=recipient_app, %2=recipient_app) => NOT FOUND (0)
map_lookup(mailertable, ., %0=., %1=recipient_app.com) => NOT FOUND (0)
recipient@recipient_domain.com... Connecting to smtp.my_domain.com.br port 587 via relay...
220 a2-smithers5.uhserver.com ESMTP
>>> EHLO localhost.localdomain
250-a2-smithers5.uhserver.com
250-PIPELINING
250-SIZE 41943040
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN LOGIN PLAIN
250-AUTH=LOGIN PLAIN LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
map_lookup(macro, {TLS_Name}, %0={TLS_Name}, %1=smtp.my_domain.com.br) =>  (0)
map_lookup(access, TLS_Srv:smtp.my_domain.com.br, %0=TLS_Srv:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:my_domain.com.br, %0=TLS_Srv:my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:com.br, %0=TLS_Srv:com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:br, %0=TLS_Srv:br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36.31, %0=TLS_Srv:200.147.36.31) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36, %0=TLS_Srv:200.147.36) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147, %0=TLS_Srv:200.147) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200, %0=TLS_Srv:200) => NOT FOUND (0)
map_lookup(access, TLS_Srv:, %0=TLS_Srv:) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:smtp.my_domain.com.br, %0=AuthInfo:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:200.147.36.31, %0=AuthInfo:200.147.36.31) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:, %0=AuthInfo:) => "U:my_user@my_domain.com.br" "I:my_user@my_domain.com.br" "P:brlight2012" "M:PLAIN" (0)
>>> AUTH PLAIN YWRtaW5AbGlnaHRiYXNlLmNvbS5icgBhZG1pbkBsaWdodGJhc2UuY29tLmJyAGJybGlnaHQyMDEy
235 2.7.0 Authentication successful
>>> MAIL From:<[email protected]> SIZE=97 [email protected]
550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, MAILER-DAEMON, %0=MAILER-DAEMON) => NOT FOUND (0)
map_lookup(host, my_domain.com.br, %0=my_domain.com.br) => my_domain.com.br. (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
root... Connecting to local...
root... Sent
Closing connection to smtp.my_domain.com.br
>>> QUIT

NOTE: The "my_user@my_domain.com.br" account is able to send email to the "recipient@recipient_domain.com" account from its webmail.

ERROR: "550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english).

10
  • 1
    For debugging add -Amswitch to sendmail command line. [It requires root privileges but you execute it as root anyway]. Later you may add also -d60.5 to trace map lookups (it would include authinfo lookups).
    – AnFi
    Jan 20, 2020 at 13:46
  • @AnFi The error "Connection refused by alt4.recipient-smtp-in.l.recipient_domain.com" is happening, but when the same email is sent from webmail, everything works. What may be missing? =/ Jan 20, 2020 at 14:06
  • @AnFi Using "-d60.5" other errors are observed ("NOT FOUND"). Jan 20, 2020 at 14:13
  • 1
    Your sendmail "does not see" smart-host configuration. FIX quotes in your mc file. m4 program expects `x' quotes.
    – AnFi
    Jan 20, 2020 at 14:45
  • 1
    Add -f my_user@my_domain.com.br to sendmail command lines options. It will fix/change email address used in MAIL FROM:. It should be sufficient for testing. Proper (final) fix will require sender email address rewriting/masquerading.
    – AnFi
    Jan 20, 2020 at 17:12

2 Answers 2

1
  1. mc files expects `x' quotes [fixed in revised version of the question]

    1. You have deployed standard recommendation to forbid sending "plain text" (unencrypted) password over unencrypted SMTP connections [p flag in confAUTH_OPTIONS].

    2. Your smart host offers only plaintext authentication [see AUTH lines in EHLO reply] but it does not offer upgrading to encrypted connection [no STARTTLS in EHLO reply].

    3. Effectively your configuration forbids to send unencrypted password over unencrypted SMTP connection but your smart host offers no other option.
1
  • What kind of settings do I need to enable "encrypted password"? Jan 20, 2020 at 17:05
0

The error...

"550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english)

... happens because the SMTP service in use by us requires that the "envelope sender" be the same as the effective "sender".

To address this issue we need to build a genericstable database to map the input sender address to the desired address.

In our case, create the file "/etc/mail/genericstable" with the entry root my_user@my_domain.com.br and add the entry FEATURE(genericstable',hash -o /etc/mail/genericstable.db')dnl in the "/etc/mail/sendmail.mc" file.

For a better understanding, below is the complete procedure.


Sendmail - Installation and configuration

Run the following to update and install dependencies...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create an auth file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo"

Building a "genericstable" database to map the input sender address to the desired address ("envelope sender").

Create the "genericstable" file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
root           my_user@my_domain.com.br

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/genericstable"

Configure Sendmail with "SMART_HOST".

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl
FEATURE(`genericstable',`hash -o /etc/mail/genericstable.db')dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test your configuration

read -r -d '' EMAIL_CONTENT << 'HEREDOC'
BEGIN
From: my_user@my_domain.com.br
To: recipient@recipient_domain.com
Subject: Fail2ban test

Fail2ban test

END
HEREDOC
echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com

[Refs.: http://blog.achinthagunasekara.com/2015/08/how-to-configure-sendmail-to-work-with.html , https://access.redhat.com/discussions/2959431 , https://docs.cloud.oracle.com/iaas/Content/Email/Reference/sendmail.htm , https://serverfault.com/a/574118/276753 , https://serverfault.com/a/839476/276753 , https://superuser.com/a/1448009/195840 , https://tecadmin.net/sendmail-to-relay-emails-through-gmail-stmp/ , https://www.bonusbits.com/wiki/HowTo:Configure_SendMail_to_Use_SMTP_Relay , https://www.sitepoint.com/community/t/email-mx-records-vs-spf-records/7947 ]


Further question/Plus: Why use Sendmail with relay?

The biggest problem with sendmail is that a lot of spammers like to use it to blast out emails without needing a domain name, so it gets rejected frequently. If you have a SMTP you can relay through that will help matters a bit.

[Ref.: https://support.nagios.com/forum/viewtopic.php?f=7&t=28246 ]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .