0

I am trying to configure configure sendmail to use a relay. I've tried several procedures, but I don't know why it doesn't work since the same relay is used by other services and it works.

Below is the installation procedure I am using.

What can I do to diagnose what happens? What could be wrong?

Thanks!


Installation and configuration

Run the following to update and install...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create directory for storing authentication files...

mkdir /etc/mail/authinfo
chmod 700 /etc/mail/authinfo

Create a auth file...

TIP: The file may have any name like "smtp-auth".

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo/smtp-auth"

Create a hash map file of above created auth file...

enter code heremakemap hash /etc/mail/authinfo/smtp-auth < /etc/mail/authinfo/smtp-auth

Configure Sendmail with SMART_HOST...

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test and output

[root@localhost ~]# read -r -d '' EMAIL_CONTENT << 'HEREDOC'
> BEGIN
> From: my_user@my_domain.com.br
> To: recipient@recipient_domain.com
> Subject: Fail2ban test
> 
> Fail2ban test
> 
> END
> HEREDOC
[root@localhost ~]# echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
map_lookup(mailertable, recipient_app.com, %0=recipient_app.com) => NOT FOUND (0)
map_lookup(mailertable, .com, %0=.com, %1=recipient_app, %2=recipient_app) => NOT FOUND (0)
map_lookup(mailertable, ., %0=., %1=recipient_app.com) => NOT FOUND (0)
recipient@recipient_domain.com... Connecting to smtp.my_domain.com.br port 587 via relay...
220 a2-smithers5.uhserver.com ESMTP
>>> EHLO localhost.localdomain
250-a2-smithers5.uhserver.com
250-PIPELINING
250-SIZE 41943040
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN LOGIN PLAIN
250-AUTH=LOGIN PLAIN LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
map_lookup(macro, {TLS_Name}, %0={TLS_Name}, %1=smtp.my_domain.com.br) =>  (0)
map_lookup(access, TLS_Srv:smtp.my_domain.com.br, %0=TLS_Srv:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:my_domain.com.br, %0=TLS_Srv:my_domain.com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:com.br, %0=TLS_Srv:com.br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:br, %0=TLS_Srv:br) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36.31, %0=TLS_Srv:200.147.36.31) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147.36, %0=TLS_Srv:200.147.36) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200.147, %0=TLS_Srv:200.147) => NOT FOUND (0)
map_lookup(access, TLS_Srv:200, %0=TLS_Srv:200) => NOT FOUND (0)
map_lookup(access, TLS_Srv:, %0=TLS_Srv:) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:smtp.my_domain.com.br, %0=AuthInfo:smtp.my_domain.com.br) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:200.147.36.31, %0=AuthInfo:200.147.36.31) => NOT FOUND (0)
map_lookup(authinfo, AuthInfo:, %0=AuthInfo:) => "U:my_user@my_domain.com.br" "I:my_user@my_domain.com.br" "P:brlight2012" "M:PLAIN" (0)
>>> AUTH PLAIN YWRtaW5AbGlnaHRiYXNlLmNvbS5icgBhZG1pbkBsaWdodGJhc2UuY29tLmJyAGJybGlnaHQyMDEy
235 2.7.0 Authentication successful
>>> MAIL From:<root@localhost.localdomain> SIZE=97 AUTH=root@localhost.localdomain
550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, root, %0=root) => NOT FOUND (0)
map_lookup(dequote, MAILER-DAEMON, %0=MAILER-DAEMON) => NOT FOUND (0)
map_lookup(host, my_domain.com.br, %0=my_domain.com.br) => my_domain.com.br. (0)
map_lookup(host, recipient_app.com, %0=recipient_app.com) => recipient_app.com. (0)
root... Connecting to local...
root... Sent
Closing connection to smtp.my_domain.com.br
>>> QUIT

NOTE: The "my_user@my_domain.com.br" account is able to send email to the "recipient@recipient_domain.com" account from its webmail.

ERROR: "550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english).

  • 1
    For debugging add -Amswitch to sendmail command line. [It requires root privileges but you execute it as root anyway]. Later you may add also -d60.5 to trace map lookups (it would include authinfo lookups). – AnFi Jan 20 '20 at 13:46
  • @AnFi The error "Connection refused by alt4.recipient-smtp-in.l.recipient_domain.com" is happening, but when the same email is sent from webmail, everything works. What may be missing? =/ – Eduardo Lucio Jan 20 '20 at 14:06
  • @AnFi Using "-d60.5" other errors are observed ("NOT FOUND"). – Eduardo Lucio Jan 20 '20 at 14:13
  • 1
    Your sendmail "does not see" smart-host configuration. FIX quotes in your mc file. m4 program expects `x' quotes. – AnFi Jan 20 '20 at 14:45
  • 1
    Add -f my_user@my_domain.com.br to sendmail command lines options. It will fix/change email address used in MAIL FROM:. It should be sufficient for testing. Proper (final) fix will require sender email address rewriting/masquerading. – AnFi Jan 20 '20 at 17:12
1
  1. mc files expects `x' quotes [fixed in revised version of the question]

    1. You have deployed standard recommendation to forbid sending "plain text" (unencrypted) password over unencrypted SMTP connections [p flag in confAUTH_OPTIONS].

    2. Your smart host offers only plaintext authentication [see AUTH lines in EHLO reply] but it does not offer upgrading to encrypted connection [no STARTTLS in EHLO reply].

    3. Effectively your configuration forbids to send unencrypted password over unencrypted SMTP connection but your smart host offers no other option.
  • What kind of settings do I need to enable "encrypted password"? – Eduardo Lucio Jan 20 '20 at 17:05
0

The error...

"550 5.7.1 Envio nao autorizado - Verifique o MX e/ou SPF do seu dominio" (portuguese)/"550 5.7.1 Unauthorized sending - Check your domain's MX and/or SPF" (english)

... happens because the SMTP service in use by us requires that the "envelope sender" be the same as the effective "sender".

To address this issue we need to build a genericstable database to map the input sender address to the desired address.

In our case, create the file "/etc/mail/genericstable" with the entry root my_user@my_domain.com.br and add the entry FEATURE(genericstable',hash -o /etc/mail/genericstable.db')dnl in the "/etc/mail/sendmail.mc" file.

For a better understanding, below is the complete procedure.


Sendmail - Installation and configuration

Run the following to update and install dependencies...

yum -y update
yum -y install sendmail-cf
yum -y install m4
yum -y install cyrus-sasl-plain

Create an auth file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
AuthInfo:smtp.my_domain.com.br "U:root" "I:my_user@my_domain.com.br" "P:my_password"

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/authinfo"

Building a "genericstable" database to map the input sender address to the desired address ("envelope sender").

Create the "genericstable" file...

read -r -d '' FILE_CONTENT << 'HEREDOC'
BEGIN
root           my_user@my_domain.com.br

END
HEREDOC
echo -n "${FILE_CONTENT:6:-3}" > "/etc/mail/genericstable"

Configure Sendmail with "SMART_HOST".

Add following configuration lines into your "sendmail.mc" configuration file immediately before "MAILER(smtp)dnl" line...

vi /etc/mail/sendmail.mc

Content...

define(`SMART_HOST', `smtp.my_domain.com.br')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo', `hash -o /etc/mail/authinfo/smtp-auth.db')dnl
MASQUERADE_AS(my_domain.com.br)dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
MASQUERADE_DOMAIN(my_domain.com.br)dnl
FEATURE(`genericstable',`hash -o /etc/mail/genericstable.db')dnl

Re-build sendmail's configuration...

make -C /etc/mail

Enable and start the sendmail service...

systemctl enable sendmail.service
systemctl restart sendmail.service

Test your configuration

read -r -d '' EMAIL_CONTENT << 'HEREDOC'
BEGIN
From: my_user@my_domain.com.br
To: recipient@recipient_domain.com
Subject: Fail2ban test

Fail2ban test

END
HEREDOC
echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v recipient@recipient_domain.com

[Refs.: http://blog.achinthagunasekara.com/2015/08/how-to-configure-sendmail-to-work-with.html , https://access.redhat.com/discussions/2959431 , https://docs.cloud.oracle.com/iaas/Content/Email/Reference/sendmail.htm , https://serverfault.com/a/574118/276753 , https://serverfault.com/a/839476/276753 , https://superuser.com/a/1448009/195840 , https://tecadmin.net/sendmail-to-relay-emails-through-gmail-stmp/ , https://www.bonusbits.com/wiki/HowTo:Configure_SendMail_to_Use_SMTP_Relay , https://www.sitepoint.com/community/t/email-mx-records-vs-spf-records/7947 ]


Further question/Plus: Why use Sendmail with relay?

The biggest problem with sendmail is that a lot of spammers like to use it to blast out emails without needing a domain name, so it gets rejected frequently. If you have a SMTP you can relay through that will help matters a bit.

[Ref.: https://support.nagios.com/forum/viewtopic.php?f=7&t=28246 ]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.