sootsnoot's questions

This a short specific technical question about an exchange between two MTAs. It is derived from this question in Superuser, which is broader and contains some rants about technical support from specific email providers. Below is a highly-sanitized version of log file entries taken from the logs of an outgoing MTA, where 1.2.3.4 is the IP address of the outgoing MTA, and 5.6.7.8 is the IP address of the receiving MTA. The original sender received no bounce message, and the mail was never delivered to the recipient (neither inbox nor spam folder nor trash). I would like to understand the meaning of the bounce="false" parameter in the 553 response from the receiving MTA. (Note that the entries are ordered newest-to-oldest, as shown by the timestamps). Thanks!

20210812 09:29:10.177 core sid="id1" id="id1id2"
    ip="1.2.3.4" action="PERMERR" dstmta="5.6.7.8" age="61" code="553"
    reason="553 5.3.0 198.71.225.36 Your message was rejected for possible spam/virus
    content.Please ask your email provider to visit http://emailadmin.registeredsite.com
    for resolution.\r\n" account="[email protected]""
    fwd="0" bounce="false" mailfrom="[email protected]" fromdomain="sending-example.com"
    recipient_list="[email protected]" todomain="receiving-example.com"
    subject="Sad news" subject_hash="f35ba6823f3a91025f0a495ed7de3b59" script="" script_ip=""

20210812 09:28:09.658 core sid="id1" id="id1id2"
    ip="1.2.3.4" action="ACCEPT" reason="CLEAN" account="[email protected]"
    fwd="0" mailfrom="[email protected]" fromdomain="sending-example.com"
    recipient_list="[email protected]" todomain="receiving-example.com" subject="Sad news"
    subject_hash="f35ba6823f3a91025f0a495ed7de3b59" script="" script_ip=""

Edit 1:

This doesn't really answer the question as asked, but in subsequent support calls with the two email providers involved, there seemed to be some agreement that the receiving MTA that gave the 553 response to the sending MTA was the one that should have sent a bounce message to the envelope sender. However, an agent for the receiving MTA pointed out to me today that their 553 response itself contains a 3rd IP address: 198.71.225.36. And that that address is the one being complained about, and it is in fact blacklisted if you check at the url contained in the message. All this time I hadn't noticed that address as relevant (or even an address, could have been section numbers like 5.3.0 or something). The 1.2.3.4 was the IP address for the server identified by the MX entry in the zone file for the sending domain, so I assumed it was the one that must have been blacklisted! I haven't yet gotten an explanation for the 'bounce="false"' parameter, or which server generated it.

I was at a friend's house who has Consolidated DSL service (soo slow). She started having problems where Chrome (on her Windows 10 desktop) started reporting that it could not find the IP address for any well-known hosts. I connected my Windows 10 laptop directly to her Zyxel vmg4825-b10a dsl modem/router and tried "ping google.com". It said it couldn't find the IP address. A few minutes later, I tried again, and it worked, getting 4 replies with times in the tens of milliseconds range. A few minutes after that, I tried again, and it was back to reporting it was unable to find the IP address for google.com. This makes no sense to me, as I thought that Windows would cache the working IP address result for a whole lot longer than the time I was away.

Eventually, the problem went away on its own, so I could only conclude that Consolidated fixed a problem with its DNS servers. So I can't reproduce the problem.

I hadn't thought to try "ipconfig /displaydns" at the time. But subsequent experiments with the same laptop on my own FIOS network suggest that a ping of google.com causes the IP address to show up in the output of "ipconfig /displaydns | grep google.com" for quite a while. Can anyone explain this behavior? Is there a fixed time that DNS lookups get cached? Can the remote DNS server cause Windows to flush its cache? I see that the output of ipconfig/displaydns does not include the IP address that was found for google.com, so maybe it's not really a cache, though I don't understand why it would remember the name without the address...

On a completely different note: I wanted to record the exact error message produced by the ping command when it failed to find the address for a name, so that I could include it here. So I tried ping with a non-existent domain. But I can't make it happen on my network at home, instead I get this:

$ ping blurfo.blurfo

Pinging blurfo.blurfo [92.242.140.21] with 32 bytes of data:

Any nonexistent name I can come up with gets mapped to 92.242.140.21. What's up with that??

I read this answer to a similar question asked some time ago, and it made good sense and matched the Apache 2.4 documentation. But I had the following experience, which seems to contradict that answer and the documentation. Consider the following directives:

<Directory "/opt/lampp/htdocs/foo">
    AuthName "foo user"
    AuthType Basic
    Authuserfile /opt/lampp/passwds/foo.users
</Directory>
<VirtualHost *:80>
    ServerName   foo.example.com
    DocumentRoot "/opt/lampp/htdocs/foo/public"
    ErrorLog     "logs/foo.error_log"
    <Location />
        Require valid-user
    </Location>
    <Location /wp/feed>
        Require all granted
    </Location>
    CustomLog    "logs/foo.access_log" combined
</VirtualHost>

The intent, clearly, is to protect all urls with http basic authentication, except for urls below /wp/feed. But after reloading apache, I got prompted for credentials when going to /wp/feed. That url matches both of the Location paths, so apache should have processed Require valid-user followed by Require all granted, and I should not have been prompted. Just for "fun", I tried switching the order of the location blocks, but still got prompted. The only thing I could find that worked as I intended was to remove the location block for "/" entirely. To me, that also was unexpected behavior because in that case there were no Require valid-user directives at all that should have been applied to urls not matching /wp/feed. And yet they were applied, since I got prompted for all urls that did not match /wp/feed.

Can anyone explain this? Am I just missing the boat in understanding the answer and documentation?

I had no problem specifying this behavior with nginx directives, where the longest prefix match generally wins. If what I got really is the expected behavior, how can I get what I want with apache?

What I'm trying to do is have a server block such that requests for my domain without a subdomain specified successfully serves any existing file with the uri prefix /.well-known/acme-challenge/, but gives a 404 for anything else.

    server {
    listen       443 ssl;
    listen       80;
    server_name  example.com;
    # Satisfy acme verification for both ports 443 and 80
    location /.well-known/acme-challenge/ {
        alias /usr/share/nginx/acme-challenges/;
        try_files $uri =404;
        return 200;
    }
    location / {
        return 404;
    }
}

What I'm finding is that if file /usr/share/nginx/acme-challenges/foo exists and is readable by the nginx process, then for request http://example.com/.well-known/acme-challenge/foo, foogets downloaded successfully - but I get a 404 status code and the default nginx error page for it. Initially, I did not have the return 200; line after the try_files because I thought that if the try_files succeeded, no other location block would be involved. I tried adding that to "make sure" the other location block would not execute, but it didn't help.

I'm sure the other location block is causing the 404, because if I change its contents to return 200; then I get the successful download and no body (whatever was displayed, e.g. the google home page remains in place when I type the request in the address bar).

I can't make any sense of this. The docs note that try_files can cause an internal redirect when a fallback uri is selected, but not when the initial file succeeds!

• Host: Amazon Linux with OpenSSH 6.6.1, OpenSSL 1.0.1k-fips 8 Jan 2015
• Client: Win 10 with Cygwin OpenSSH 7.3p1, OpenSSL 1.0.2h 3 May 2016

I can ssh interactively with no problem:

win10$ ssh [email protected]
aws$

This port forwarding also works:

win10$ ssh -NTL 9003:localhost:80 [email protected] &
win10$

I use the latter to access phpmyadmin on the server through:

http://phpmyadmin.localhost:9003

That works fine.

In order to use netbeans to debug php code running on the server, I do:

win10$ ssh -NTR 9000:localhost:9000 [email protected] &

This used to work okay. But after upgrading Cygwin, I now get:

ssh: connect to host example.com port 22: Operation not permitted

Adding a -vvvv to the command line doesn't give much more information:

win10$ ssh -vvvv -NTR 9000:localhost:9000 [email protected]
OpenSSH_7.3p1, OpenSSL 1.0.2h  3 May 2016
debug1: Reading configuration data /home/user/.ssh/config
debug2: resolving "example.com" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to example.com [nn.nn.nn.nn] port 22.
debug1: connect to address nn.nn.nn.nn port 22: Operation not permitted
ssh: connect to host example.com port 22: Operation not permitted

I believe that the previous version of ssh that worked for me doing this was Cygwin on WinXP with OpenSSH 7.1p2, OpenSSL 1.0.2f, 28 Jan 2016

Nothing has changed on the server. Since port 9000 is not privileged, I don't think it should be a permission problem, especially since the server config hasn't changed, but I have to admit that port forwarding is basically magic to me. Any ideas what might be wrong or how to collect more/better information?

Using nginx 1.8.1 on an Amazon Linux EC2 instance. Using as a reverse proxy to support https for Apache running on a different instance. All is working fine, except for this issue.

I want to serve a static page from nginx in case I want to take the Apache server instance down. So I did this:

    location   / {
        try_files /site-down.html $uri @backend;
    }

So before I shut down the backend server, I create a symbolic link in the nginx server's root directory to a static html file that looks like this:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

  <title>example.com</title>
  <style type="text/css">
  body {
    background-image:url('/images/back-soon-background.jpg');
    font-family: arial,verdana,sans-serif;
    text-align: center;
  }
  #msg {
    background-image: url('/images/back-soon-oval.png');
    background-repeat: no-repeat;
    width: 600px;
    padding-top: 140px;
    padding-left: 50px;
    padding-right: 50px;
    padding-bottom: 150px;
  }
  </style>
</head>

<body>
<div id="msg">
<h1>Sorry, the site is currently unavailable.</h1>
<h2>We expect to be back within 2 hours.</h2>
</div>
</body>
</html>

The problem is that when I do that, the page gets displayed immediately as just the text content of the div, without the images specified by the <style> in the <head> section. Using Chrome developer tools Network tab, I can see requests for the image urls going out, and getting 200 status codes. But if I click on those requests, there is no preview available, and the body length is too short. Reloading the page doesn't help right away. But if I let it sit there for a while, eventually the correct output with the images appears. If I point my browser directly at /site-down.html, the page displays correctly right away.

Both Chrome 52.0.2743.116 m and Firefox 48.0.2 behave the same way. I'm new to nginx, but I can't imagine why the first uri in a try_files should behave any differently from going directly to that uri in the case where the file exists. What am I missing?

Running Amazon Linux on EC2 instance with sendmail. I have an email account with Network Solutions, and use that account as a SMART_HOST relay in my sendmail configuration. It works well except for one little detail.

In my maillog file I see entries like this:

sendmail[28450]: STARTTLS=client, relay=mail.example.com.netsolmail.net., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256

After a little research, I've come to the conclusion that the verify=FAIL is essentially harmless: the connection actually was encrypted, it's just that the host's certificate could not be verified.

Since nobody but me reads the log file, I wouldn't care. But when the message arrives, the Received header shows

Received: from unknown (HELO example.com) ([email protected]@12.34.56.78)
  by 0 with ESMTPA; 15 Aug 2016 07:10:15 -0000

I was hoping to see with ESMPTSA but I would guess that the certificate verification failure caused the 'S' to be surpressed.

How can I get more detail on what was wrong with the certificate, and how can avoid the verification failure? My guess is that the multiple subdomains of mail.example.com.netsolmail.net don't match closely enough with the name on the certificate. But how can I verify that, and how can I avoid the complaint - or more exactly how can I get the Received header to acknowledge the secure connection with ESMTPSA.

EDIT: I edited sendmail.mc to add

define(`confLOG_LEVEL', `15')dnl

Now maillog gives more details. Right after the verify=FAIL line I now see:

sendmail[30706]: STARTTLS=client, cert-subject=/OU=GT39680792/OU=See+20www.rapidssl.com/resources/cps+20+28c+2915/OU=Domain+20Control+20Validated+20-+20RapidSSL+28R+29/CN=*.hostingplatform.com, cert-issuer=/C=US/O=GeoTrust+20Inc./CN=RapidSSL+20SHA256+20CA+20-+20G3, verifymsg=unable to get local issuer certificate

I take this to mean that at least one cause of the verification failure is that sendmail can't find a certificate for the local machine it's running on? Since I'm only relaying outgoing mail to a netsol server, never accepting incoming mail from the internet, I didn't think I'd need to have a certificate for this server. If I need one, where/how do I install it? And can it be the same certificate I use for my webserver, or do I need a different one? Would use of a self-signed certificate be good enough to get the Received header to say with ESMTPSA, or would it need to be a commercial certificate from a CA?

EDIT #2:

I'm accepting the answer by @MadHatter. The key was getting confCACERT defined. I'm embarrassed, my only excuse is old senile brain not grocking m4 source. The default sendmail.mc file on Amazon Linux already had

define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl

in it, and I had verified that the file existed. But I failed to notice the sneaky little dnl that was actually at the beginning of those lines! I know what it means, but since I very rarely look at m4 source, and it was right after some other dnl-ed lines that were marked as comments with #, my brain registered them as not being commented out!

I actually went through a bunch of gyrations downloading certs from Firefox and pointing sendmail at the Digicert certificate that I use for our website, but since this host only ever sends, never receives, email, nothing else was necessary. I put back the dnl on the defines for confSERVER_CERT and confSERVER_KEY, and all was well, with maillog showing verify=OK and verifymsg=ok on the appropriate STARTTLS=client lines.

But even though there were no diagnostics about TLS, the Received header for the connection to netsol still shows with ESMTPA and not with ESMTPSA. Oh well, @MadHatter had the dope on that one, too. Sorry this was so long and sort of a wild goose chase. But I learned a lot, and I did improve my configuration (in a non-vital way). I hope someone desperate enough to wade through this might learn something, too.

I've had a problem recently with spam coming in with an envelope-from consisting of my own address. At first I thought this meant that my password had been compromised, mistakenly thinking that the "with esmtp (Exim 4.87)" in the "by" clause of my email server's Received header meant that it came over an authenticated connection. My email provider quickly corrected me, that incoming messages come from MTAs, and MTAs do not authenticate when passing along a message. So it could just as easily (and most likely did) come through an open relay, as the IP addresses were all listed on 15 or more blacklists.

When I send mail from Thunderbird, I connect on port 587, and that port requires authentication. If I could look at the headers and see that the connection to my ISP's server was on port 587, then I would know that the sender authenticated, and if it had my own address as its envelope-from, then I would know that my password had been compromised, right? Well I guess any server in the trace can modify the earlier headers, but in these cases there aren't any other servers in the trace. And even if there were, it's not clear why a server would want to modify the port number given in an earlier header.

I tried asking the email provider if they could add the port to their "Received by" clause and didn't get a meaningful response. I googled a bit to see if sendmail had an option to do this but got nowhere. However, I guess the header actually tells me they are using Exim rather than sendmail, and this link shows where the header content is configured in Exim, though it doesn't say how to refer to the incoming port number in the text.

But given that the port number seems to provide some very valuable information to anyone dealing with spam from spoofed senders, I wonder why it isn't included by default.

I'm on Amazon AWS EC2 running Amazon Linux, though that may not be significant to the answer.

Say I have three hosts, H1, H2, H3, with private IP addresses of 10.0.0.1, 10.0.0.2, and 10.0.0.3. This could be represented in a /etc/hosts file with these lines:

127.0.0.1   localhost localhost.localdomain
10.0.0.1    H1
10.0.0.2    H2
10.0.0.3    H3

In php code I do things like run curl to access stuff on a particular host, based on implicit knowledge of what that hosts offers. I'd rather not concern myself with whether the particular host I'm accessing is the host running the code itself, just access H1, H2, or H3. I could use a different /etc/hosts file on each host, changing the line with its private IP address to use the address 127.0.0.1. But is that actually significant? If I use identical /etc/hosts files on all the machines, am I sacrificing any performance or functionality?

Does network access made to a machine's own private IP address actually cause real "external" traffic or is it detected and uses the loopback connector like 127.0.0.1 does anyway? Does the process receiving the request see the originating address as the machine's own private IP address, or does it see 127.0.0.1 anyway?

I've read a bunch of articles on taking consistent backups of mySQL, including What's the meaning of consistent dataset? (MySQL), but I still don't think I know enough to answer this question with confidence. I originally posted this question on stackoverflow, but was advised by a couple of high-reputation members that this would be a better place for it. So I'm basically copy-pasting the question here and deleting it from there. Hope that's an acceptable practice - I asked for help on how to go about moving the question, but didn't get any.

Running MySQL 5.5 using only InnoDB tables with file-per-table enabled backing a multi-user website hosted on Amazon EC2 running Amazon Linux.

From what I've been able to find here and other Stack Exchange sites, it sounds like it's okay to copy the whole data tree to make a valid backup after shutting down the server.

What I'm currently doing for backups is:

1. stop apache
2. stop mysql
3. take lvm2 snapshot of the volume containing the data directory
4. start mysql
5. start apache
6. use rsnapshot to copy the lvm2 snapshot to a different volume
7. delete the lvm2 snapshot

In his answer to https://stackoverflow.com/questions/9165118/lvm-mysql-backup/9165604#9165604, Bill Karwin noted that lvm snapshots can seriously degrade I/O performance. But I believe that since the lvm snapshot is only active for the short time it takes rsnapshot (which uses rsync) to complete, performance shouldn't be seriously impacted.

So my question is whether I really need to stop the servers while taking the lvm snapshot. I think I read somewhere that although an "instant in time" snapshot could catch InnoDB tables with incomplete transactions, that if that happens mySQL will deal with them consistently when started again. So I'm thinking that stopping the server might be overkill, even though it's only stopped for a very short time while the lvm snapshot is taken. (I first stop apache so requests can't come in without a database running).

I'll certainly check out Bill's advice on http://www.percona.com/software/percona-xtrabackup. And it seems to get cited a lot here. Does it work well with MySQL 5.5, or do I need to install Percona Server? In the meantime, I'd like to know if I can make an incremental improvement to what I'm doing - or if what I'm doing is already broken!

I use MantisBT 1.2.6 on an Amazon Linux server. It has its own email-sending class layered on top of the PHP mail() function. Actually, it has other options to use smtp or sendmail directly, but I use PHP mail. Then PHP mail in turn uses sendmail.

I configured sendmail to use a smart host, which was working fine as I could write a little PHP program to send a message successfully through its mail() function.

But mail sent by MantisBT never arrived and did not bounce.

/var/log/maillog showed the MantiBT messages being sent to the smarthost successfully

(relay=my-smarthost-hostname) with "stat=Sent (ok nnnn qp nnnn)"

If I changed the /etc/mail/authinfo file to use the wrong password, maillog showed "stat=Service unavailable" for that relay.

So it seemed the problem had to be something subtle in the MantiBT code. I used xdebug to find the call it made to mail(), and get the values of its parameters, and extracted them to a separate php file to play with. It passed a number of headers in addition to "From:" in the fourth parameter, and I suspected that they might have been separated by just \n instead of \r\n as the RFC (2)821 requires, which caused the problem. But I added code to change \n to \r\n in the header string and that made no difference.

In the end, what caused the problem was the presence of a (correct) "Date:" header. When I removed that header from the 4th parameter to mail(), the mail got delivered immediately. So I edited the MantisBT source not to generate that header, and all was fine (I also edited the MantisBT source not to put a space between the "-f" option and the sender address).

So my question is just whether the presence of a "Date:" header in the 4th parameter to mail() is known to cause a problem sending through a smarthost. With a follow-on of wouldn't you expect either a bounce or a message in maillog if the smarthost didn't like seeing the Date header?

PS I actually called Network Solutions technical support about it when I saw the sent ok message in maillog, but before I isolated it to the Date header. Naturally that yielded nothing useful, just instructions for how to configure your email client for POP or IMAP :-)

Environment is Amazon EC2, running Amazon Linux (Centos-like) with sendmail 8.14.4 and Cyrus sasl 2.1.23. The machine has an elastic IP address that is the target of a domain name, and reverse DNS is setup for it. MX record points at an external server, so the machine does not deal with any incoming internet email, only outgoing. For all outgoing off-node email, I want to use a TLS authenticated connection to smtp.googlemail.com.

There are lots of tutorials and articles about this kind of setup (several on this site and its sister sites), as it seems to be a fairly popular way of dealing with email in the cloud. I've been reading every one I can find, trying different things, and studying /var/log/maillog. But for the life of me, I'm stumped. It's not that I can't send email with sendmail, or that I can't send it through an authenticated TLS connection to smtp.googlelemail.com: it's just that I can't get sendmail to send it through such a connection! I admit I'm a sendmail newbie, and I know it has a reputation for difficult configuration, so I've really put a lot of time into it. But I've run out of clues and ideas at this point.

I have one php application on the machine that uses Zend Framework (1.11), and it uses Zend_Mail_Transport_Smtp. In the constructor for the transport I specify smtp.googlemail.com, port 587, tls, [email protected], and password. The email from that application gets sent lickity-split and arrives with nice clean headers (I also added a TXT record including google's spf txt records to the domain's zone file).

I have another application that uses php mail directly, and php mail relies on sendmail. That application also is able to send mail that arrives okay under the default sendmail configuration supplied with the Amazon Linux AMI (which does not relay through googleemail). But the headers in the arriving messages are not so clean, at least one thing being that there is a "neutral" complaint from the spf check. So I'm not stuck without email, it's just that I'd like to be able to use sendmail for its greater reliably with queueing outgoing mail in case of multi-user bursts of emails coming from the website (as all those new users of the Zend Framework application sign up for accounts :-), and I don't want users looking at the headers and thinking things may not be quite right.

So the goal here is just to modify the existing working sendmail configuration to relay outgoing mail through a port 587 tls connection to googlemail, just the way that the Zend Framework application does with no problem. And then I can modify the Zend Framework application to use sendmail to get the overload protection of queueing.

How hard can it be I thought...

What I'm finding is that with the changes in place in the sendmail configuration, outgoing messages invariably get stuck with this message in /var/log/maillog:

"timeout waiting for input from googlemail-smtp.l.google.com. during client greeting"

The messages then go into the mailq and stay there, failing each time they get re-tried.

Here are diffs between the sendmail.cf that works by sending directly, and the one modified to relay through google:

# diff sendmail.mc-orig sendmail.mc-new
26c27,30
< dnl define(`SMART_HOST', `smtp.your.provider')dnl
---
> define(`SMART_HOST', `[smtp.googlemail.com]')dnl
> define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
> define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
> FEATURE(authinfo, `Hash -o /etc/mail/authinfo.db')dnl
52,53c56,59
< dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
< dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
---
> dnl # TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
> dnl # define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
> TRUST_AUTH_MECH(`PLAIN LOGIN')dnl
> define(`confAUTH_MECHANISMS', `PLAIN LOGIN')dnl

Here is the (sanitized) mode 600 root-owned authinfo file:
AuthInfo:[smtp.googlemail.com] "U:[email protected]" P:"xyzzy" "M:PLAIN"

I also started saslauthd, and edited /usr/lib/sasl2/Sendmail.conf to read:
pwcheck_method:saslauthd
mech_list: login plain

I did not set up any certificates, because as far as I could tell they are not necessary if sendmail is only using TLS on outgoing connections; and indeed the port 587 connection works in the Zend Framework application without certificates installed (or saslauthd running for that matter).

The level 29 maillog for a message sent with the relaying sendmail config looks like this:

[31528]: q1F5dYcB031528: [email protected], size=7085, class=0, nrcpts=1, msgid=<[email protected]>, relay=nobody@localhost
[31529]: NOQUEUE: connect from localhost [127.0.0.1]
[31529]: AUTH: available mech=PLAIN LOGIN, allowed mech=PLAIN LOGIN
[31529]: q1F5dYYY031529: Milter: no active filter
[31529]: q1F5dYYY031529: --- 220 name.compute-1.internal ESMTP Sendmail 8.14.4/8.14.4; Wed, 15 Feb 2012 05:39:34 GMT
[31529]: q1F5dYYY031529: <-- EHLO name.compute-1.internal
[31529]: q1F5dYYY031529: --- 250-name.compute-1.internal Hello localhost [127.0.0.1], pleased to meet you
[31529]: q1F5dYYY031529: --- 250-ENHANCEDSTATUSCODES
[31529]: q1F5dYYY031529: --- 250-PIPELINING
[31529]: q1F5dYYY031529: --- 250-8BITMIME
[31529]: q1F5dYYY031529: --- 250-SIZE
[31529]: q1F5dYYY031529: --- 250-DSN
[31529]: q1F5dYYY031529: --- 250-ETRN
[31529]: q1F5dYYY031529: --- 250-AUTH PLAIN LOGIN
[31529]: q1F5dYYY031529: --- 250-DELIVERBY
[31529]: q1F5dYYY031529: --- 250 HELP
[31529]: q1F5dYYY031529: <-- MAIL From:<[email protected]> SIZE=7085 [email protected]
[31529]: ruleset=trust_auth, [email protected], relay=localhost [127.0.0.1], reject=550 5.7.1 <[email protected]>... not authenticated
[31529]: q1F5dYYY031529: --- 250 2.1.0 <[email protected]>... Sender ok
[31529]: q1F5dYYY031529: <-- RCPT To:<[email protected]>
[31529]: q1F5dYYY031529: --- 250 2.1.5 <[email protected]>... Recipient ok
[31529]: q1F5dYYY031529: <-- DATA
[31529]: q1F5dYYY031529: --- 354 Enter mail, end with "." on a line by itself
[31529]: q1F5dYYY031529: from=<[email protected]>, size=7190, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
[31529]: q1F5dYYY031529: --- 250 2.0.0 q1F5dYYY031529 Message accepted for delivery
[31528]: q1F5dYcB031528: [email protected], [email protected] (99/99), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=37085, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (q1F5dYYY031529 Message accepted for delivery)
[31529]: q1F5dYYZ031529: <-- QUIT
[31529]: q1F5dYYZ031529: --- 221 2.0.0 name.compute-1.internal closing connection
[31531]: q1F5dYYY031529: SMTP outgoing connect on name.compute-1.interna
[31531]: q1F5dYYY031529: timeout waiting for input from googlemail-smtp.l.google.com. during client greeting
[31531]: q1F5dYYY031529: to=<[email protected]>, delay=00:05:00, xdelay=00:05:00, mailer=relay, pri=127190, relay=googlemail-smtp.l.google.com. [74.125.91.16], dsn=4.0.0, stat=Deferred: Connection timed out with googlemail-smtp.l.google.com.  

I do see the "ruleset=trust_auth, ... not authenticated" message, but besides not knowing how to fix it, I also see that it's immediately followed by an ok message, and the log shows it proceeding onward to try to connect to the relay, so I think that has nothing to do with the timeout... If I'm wrong and someone could tell me how to fix it, that would be great!

The maillog for a message sent with the unmodified config that works without relaying (note that "[email protected]" is actually an address with an mx record for a Network Solutions server, which is why the final line has a relay= for a netsol.net host):

[31425]: q1F5VtLr031425: [email protected], size=6743, class=0, nrcpts=1, msgid=<[email protected]>, relay=nobody@localhost
[31426]: NOQUEUE: connect from localhost [127.0.0.1]
[31426]: AUTH: available mech=PLAIN LOGIN, allowed mech=EXTERNAL GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5
[31426]: q1F5VuPd031426: Milter: no active filter
[31426]: q1F5VuPd031426: --- 220 name.compute-1.internal ESMTP Sendmail 8.14.4/8.14.4; Wed, 15 Feb 2012 05:31:56 GMT
[31426]: q1F5VuPd031426: <-- EHLO name.compute-1.internal
[31426]: q1F5VuPd031426: --- 250-name.compute-1.internal Hello localhost [127.0.0.1], pleased to meet you
[31426]: q1F5VuPd031426: --- 250-ENHANCEDSTATUSCODES
[31426]: q1F5VuPd031426: --- 250-PIPELINING
[31426]: q1F5VuPd031426: --- 250-8BITMIME
[31426]: q1F5VuPd031426: --- 250-SIZE
[31426]: q1F5VuPd031426: --- 250-DSN
[31426]: q1F5VuPd031426: --- 250-ETRN
[31426]: q1F5VuPd031426: --- 250-DELIVERBY
[31426]: q1F5VuPd031426: --- 250 HELP
[31426]: q1F5VuPd031426: <-- MAIL From:<[email protected]> SIZE=6743
[31426]: q1F5VuPd031426: --- 250 2.1.0 <[email protected]>... Sender ok
[31426]: q1F5VuPd031426: <-- RCPT To:<[email protected]>
[31426]: q1F5VuPd031426: --- 250 2.1.5 <[email protected]>... Recipient ok
[31426]: q1F5VuPd031426: <-- DATA
[31426]: q1F5VuPd031426: --- 354 Enter mail, end with "." on a line by itself
[31426]: q1F5VuPd031426: from=<[email protected]>, size=6848, class=0, nrcpts=1, msgid=<[email protected]>, proto=ESMTP, daemon=MTA, relay=localhost [127.0.0.1]
[31426]: q1F5VuPd031426: --- 250 2.0.0 q1F5VuPd031426 Message accepted for delivery
[31425]: q1F5VtLr031425: [email protected], [email protected] (99/99), delay=00:00:01, xdelay=00:00:00, mailer=relay, pri=36743, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (q1F5VuPd031426 Message accepted for delivery)
[31428]: q1F5VuPd031426: SMTP outgoing connect on name.compute-1.interna
[31426]: q1F5VuPe031426: <-- QUIT
[31426]: q1F5VuPe031426: --- 221 2.0.0 name.compute-1.internal closing connection
[31428]: q1F5VuPd031426: to=<[email protected]>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=126848, relay=inbound.domain.netsolmail.net. [205.178.149.7], dsn=2.0.0, stat=Sent (OK FB/29-06630-5434B3F4)
[31428]: q1F5VuPd031426: done; delay=00:00:00, ntries=1  

Here is what I get using telnet:

# telnet smtp.googlemail.com 587
Trying 74.125.93.16...
Connected to smtp.googlemail.com.
Escape character is '^]'.
220 mx.google.com ESMTP j17sm7987765qaj.9

502 5.5.1 Unrecognized command. j17sm7987765qaj.9
STARTTLS
503 5.5.1 EHLO/HELO first. j17sm7987765qaj.9
EHLO localhost
250-mx.google.com at your service, [nnn.nnn.nnn.nnn]
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250 ENHANCEDSTATUSCODES
STARTTLS
220 2.0.0 Ready to start TLS

Any help greatly appreciated!