Brevo sntp with mailcow

bkalai

I have a new mailcow installation with a vpc front end
I’m trying to use Brevo for smtp relay server. The configuration is
Host smtp-relay.brevo.com:587
Username xxxxxxx@smtp-brevo.com
Password smtp key value
I try to test the configuration tab:
from addres is the username and to: an email address in my domain
I get 504 Gateway Time-out
I don’t know which log to look at and what I’m looking for
configure the domain in the email configuration tab didn’t help
what am I doing wrong?

esackbauer

bkalai I get 504 Gateway Time-out

Where do you get this? SOGo?

bkalai The configuration is
Host smtp-relay.brevo.com:587

Where did you configure this in mailcow? You have to configure this into “sender dependent transports” and assign this created transport to all your domains in mailcow.

If its working you can check in postfix logs.

bkalai

Thanks for your reply
Yes I configure this in the " sender dependent transports” but when I try to test the configuration it times out. I did it with three services and they all time out. telnet to the host works telnet smtp-relay.brevo.com 587 Trying 1.179.118.1... Connected to smtp-relay.brevo.com. Escape character is '^]'. 220 smtp-relay.brevo.com ESMTP Service Ready
The postfix logs show
postfix-mailcow-1 | Nov 27 13:32:31 debdad88b2ec postfix/smtp[9999]: 04ADDDD914: to=<agustingato56@hotmail.com>, relay=smtp-relay.brevo.com[1.179.118.1]:587, delay=147830, delays=147224/304/302/0, dsn=4.7.5, status=deferred (Cannot start TLS: handshake failure) postfix-mailcow-1 | Nov 27 13:32:31 debdad88b2ec postfix/smtp[10005]: SSL_connect error to smtp-relay.brevo.com[1.179.118.1]:587: Connection timed out

esackbauer

bkalai Cannot start TLS: handshake failure)

This is the problem, mailcows postfix tries to use TLS, but it failed.
Have you asked Brevo about it? Maybe its common with them.
I use sender dependent transport myself, but never had such an error.

esackbauer

You probably have it configured wrong. Port 587 is not a SSL port, its a plaintext port. so you have to use STARTTLS or no encrytion.

bkalai

thanks for your reply
“The standard port for STARTTLS is 587, which is the recommended port for secure email submission. While some servers may also support STARTTLS on ports 25 and 2525, port 587 is the widely accepted and most reliable choice for client applications. Port 465 is typically used for implicit TLS/SSL, not STARTTLS. ”
which port should I use? port 25 doesn’t work as well as port 465

this the setting posted on the Brevo website

esackbauer

Port 587 seems correct. Have you changed anything in TLS ciphers? For Postfix?
Are you using MTA-STS?

esackbauer

esackbauer Have you changed anything in TLS ciphers? For Postfix?

👆️

bkalai

this the setting posted on the Brevo website
host smtp-relay.brevo.com
port 587
login/user 9c9c32001@smtp-brevo.com

bkalai

this happen when i use sendgrid as well. what configuration do i need to change on mailcow?
thanks for your help

bkalai

Thanks for helping with this
I did a brand new mailcow installation version 2025-10a
Configure dkim entry in dns
added SSL certificate to match nginx proxy manager
Add sender-dependent-transport for Brevo and still getting bad gateway time I attached the last few entries from postfix logs (10.7.0.1is the front end vps)

postfix-mailcow-1 | Nov 30 12:29:48 a57b01dd924e postfix/smtpd[675]: connect from unknown[10.7.0.1] postfix-mailcow-1 | Nov 30 12:29:49 a57b01dd924e postfix/smtpd[675]: TLS SNI mail.barak-kalai.com from unknown[10.7.0.1] not matched, using default chain postfix-mailcow-1 | Nov 30 12:29:49 a57b01dd924e postfix/smtpd[675]: Anonymous TLS connection established from unknown[10.7.0.1]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 postfix-mailcow-1 | Nov 30 12:29:50 a57b01dd924e postfix/smtpd[675]: NOQUEUE: reject: RCPT from unknown[10.7.0.1]: 550 5.1.1 <barak-g@barak-kalai.com>: Recipient address rejected: User unknown in virtual mailbox table; from=<barakkalai1+caf_=barak-g=barak-kalai.com@gmail.com> to=<barak-g@barak-kalai.com> proto=ESMTP helo=<mail-ej1-f53.google.com> postfix-mailcow-1 | Nov 30 12:29:50 a57b01dd924e postfix/smtpd[675]: disconnect from unknown[10.7.0.1] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 quit=1 commands=5/7

esackbauer

The problem could be that you are using a wildcard certificate.