TLS is required, but was not offered by host alt2.gmail-smtp-in.l.google

classycraft3r

Mine is on dane by default, but the mails sent are not marked as secure by google.

gamearoo

piperino both

my datacenter did tell me this tho

Unfortunately, encrypted email services typically do not work in our network due to the smtp proxies.

no clue if that plays a role

piperino

gamearoo
ok if your smtp proxy is not offering TLS towards gmail than your issue.

[unknown]
are you proxying outgoing smtp traffic too ?

[unknown]

are you proxying outgoing smtp traffic too ?

gamearoo

piperino

@classycraft3r
are you proxying outgoing smtp traffic too?

classycraft3r

piperino Gamearoo and I are in the same VPS, just under different vms. So we are on the same host and are both proxied

gamearoo

i have no control over the proxy as i dont own the switch or rack

[unknown] i belive they are doing both however not sure it sends the email fine just not encrypted

they did tell me this as well as a thing to try

piperino

gamearoo

weird setup. and in your case gmail as receiver is offering STARTTLS.
but SMTP Proxies BS.

gamearoo

so basicly nothing i can do about it as the dc dont want to remove the proxiy

or change how it works

DocFraggle

As your datacenter wrote, you have to use a relay service then, otherwise it won’t work

blade-liger

Sorry, I know it’s too late to start the discussion but I have the same problem.
Feb 22 22:57:14 6809de8cc1c1 postfix/sogo/smtpd[365]: disconnect from mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.248] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6
Feb 22 22:57:15 6809de8cc1c1 enforced-tls-smtp/smtp[369]: connect to gmail-smtp-in.l.google.com[2800:3f0:4003:c0f::1a]:25: Network is unreachable
Feb 22 22:57:26 6809de8cc1c1 enforced-tls-smtp/smtp[369]: 6B57B3A4301E: TLS is required, but was not offered by host gmail-smtp-in.l.google.com[108.177.123.27]
Feb 22 22:57:27 6809de8cc1c1 enforced-tls-smtp/smtp[369]: connect to alt1.gmail-smtp-in.l.google.com[2a00:1450:400c:c0b::1b]:25: Network is unreachable
6B57B3A4301E: TLS is required, but was not offered by host alt1.gmail-smtp-in.l.google.com[64.233.184.26]
Feb 22 22:57:29 6809de8cc1c1 enforced-tls-smtp/smtp[369]: connect to alt2.gmail-smtp-in.l.google.com[2a00:1450:4025:401::1b]:25: Network is unreachable
Feb 22 22:57:29 6809de8cc1c1 enforced-tls-smtp/smtp[369]: 6B57B3A4301E: to=pleczerowolfus@gmail.com, relay=none, delay=18, delays=3/0.06/15/0, dsn=4.4.1, status=deferred (connect to alt2.gmail-smtp-in.l.google.com[2a00:1450:4025:401::1b]:25: Network is unreachable)

and mailcow is behind traefik and it is already working. I send emails normally to gmail and hotmail but none with tls. When I force tls from the interface I get the error mentioned above and the email is not sent.
HOW DID YOU SOLVE IT? COULD YOU HELP ME PLEASE?

esackbauer

blade-liger Network is unreachable

No, you have a different problem.
Your server is trying to reach the google SMTP server via IPv6 and cannot reach it. That means that you need to have your network stack properly set up (firewall, and DNS records, including PTR) for IPv6.
Otherwise you could disable IPv6 completely in mailcow (see the documentation)

blade-liger

Thank you very much for the advice. I have already disabled IPv6 and now I only work with IPv4 but I still have the same problem. TLS is required, but was not offered by host gmail-smtp-in.l.google.com when I try to force TLS from the administration interface and it does not send the email but if I deactivate it sends the emails but without TLS.

Feb 27 20:08:08 a40f96583e16 postfix/qmgr[355]: 4ECA63AA6E24: from=blade-liger@bladeforwardtech.com, size=972, nrcpt=1 (queue active)
Feb 27 20:08:08 a40f96583e16 postfix/sogo/smtpd[370]: disconnect from mailcowdockerized-sogo-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.248] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6
Feb 27 20:08:19 a40f96583e16 enforced-tls-smtp/smtp[380]: 4ECA63AA6E24: TLS is required, but was not offered by host gmail-smtp-in.l.google.com[142.250.0.27]
Feb 27 20:08:30 a40f96583e16 enforced-tls-smtp/smtp[380]: 4ECA63AA6E24: TLS is required, but was not offered by host alt1.gmail-smtp-in.l.google.com[64.233.184.27]
Feb 27 20:08:41 a40f96583e16 enforced-tls-smtp/smtp[380]: 4ECA63AA6E24: TLS is required, but was not offered by host alt2.gmail-smtp-in.l.google.com[142.250.27.27]
Feb 27 20:08:51 a40f96583e16 enforced-tls-smtp/smtp[380]: 4ECA63AA6E24: TLS is required, but was not offered by host alt3.gmail-smtp-in.l.google.com[142.250.153.27]
Feb 27 20:09:02 a40f96583e16 enforced-tls-smtp/smtp[380]: 4ECA63AA6E24: to=pleczerowolfus@gmail.com, relay=alt4.gmail-smtp-in.l.google.com[142.251.9.27]:25, delay=55, delays=0.61/0.06/54/0, dsn=5.7.4, status=bounced (TLS is required, but was not offered by host alt4.gmail-smtp-in.l.google.com[142.251.9.27])
Feb 27 20:09:02 a40f96583e16 postfix/cleanup[388]: E183E3AA6E35: message-id=20250228000902.E183E3AA6E35@mail.bladeforwardtech.com
Feb 27 20:09:02 a40f96583e16 postfix/bounce[386]: 4ECA63AA6E24: sender non-delivery notification: E183E3AA6E35
Feb 27 20:09:02 a40f96583e16 postfix/qmgr[355]: E183E3AA6E35: from=<>, size=3756, nrcpt=1 (queue active)
Feb 27 20:09:02 a40f96583e16 postfix/qmgr[355]: 4ECA63AA6E24: removed
Feb 27 20:09:02 a40f96583e16 postfix/lmtp[391]: E183E3AA6E35: to=blade-liger@bladeforwardtech.com, relay=dovecot[172.22.1.250]:24, delay=0.08, delays=0.01/0.02/0/0.04, dsn=2.0.0, status=sent (250 2.0.0 blade-liger@bladeforwardtech.com 2HefOJ7+wGf9AAAAZw/OFw Saved)
Feb 27 20:09:02 a40f96583e16 postfix/qmgr[355]: E183E3AA6E35: removed

DocFraggle

You have no PTR record in place:

https://mxtoolbox.com/SuperTool.aspx?action=smtp%3Amail.bladeforwardtech.com&run=toolpage

AND you are listed on 2 DNS blacklists

https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3Amail.bladeforwardtech.com&run=toolpage

I guess that’s the reason why the Google MX refuse to accept your mails

blade-liger

Thank you very much @DocFraggle
I already have a PTR record and I removed my IP from one of the blacklists and the other tells me that it is not my fault but the fault of the provider who gave me the public IP but I still cannot have an email sent with TLS

esackbauer

It looks like that there is an transparent SMTP proxy, maybe with your provider (it was already mentioned up in the thread). That proxy is not accepting a TLS connection, because it wants cleartext (probably to scan your mails for illegal content or selling data to advertisement platforms).
However mailcow tries to connect to googles servers only with TLS because it knows they support TLS.

« Previous Page