So everything else is fine Except for the certificate it's valid but it's not secure still so i went on SSL Labs and got this [upl-image-preview uuid=e390e3c1-6543-49e7-b7d5-46acb582ab22 url=https://community.mailcow.email/assets/files/2025-12-01/1764632926-313821-image-2025-12-01-184845596.png alt={TEXT?}] it got a A+ but it's just the CRL ERROR thats giving me some trouble

@"esackbauer"#p29335 I Fix the email going to spam i just need the inbound problem fixed

@"mlcwuser"#p29350 I can't put the PTR record it provided because Ionos does not provide the option to put a PTR record on the dns record @"[unknown]"#p29352 Without paying $30 without knowledge that can i change that domains PTR record. @"[unknown]"#p29352 Without paying $30 without knowledge that can i change that domains PTR record.

CRL ERROR IOException occurred

hugogr45

So everything else is fine Except for the certificate it’s valid but it’s not secure still so i went on SSL Labs and got this it got a A+ but it’s just the CRL ERROR thats giving me some trouble

mlcwuser

hugogr45 it got a A+ but it’s just the CRL ERROR thats giving me some trouble

It’s an issue with their scanner. See here and here.

hugogr45 it always goes to spam

The PTR record (Reverse DNS) for your IP address does not match the fully qualified domain name (FQDN) of your Mailcow server. See: https://docs.mailcow.email/getstarted/prerequisite-dns/#reverse-dns-of-your-ip-address

hugogr45 it does not receive it.

Ensure that all the necessary ports are open for incoming connections. To receive email from other servers, you need to open port 25: https://docs.mailcow.email/getstarted/prerequisite-system/#incoming-ports.

pkernstock

Maybe LetsEncrypt’s CRL server had some temporary issues, or they/Cloudflare is blocking SSLLabs’s tests? Seems to work for me however:

$ curl -I "http://r13.c.lencr.org/110.crl"
HTTP/1.1 200 OK
Date: Tue, 02 Dec 2025 00:27:01 GMT
Content-Type: application/pkix-crl
Content-Length: 235910
Connection: keep-alive
Server: cloudflare
x-amz-id-2: pB/8yq9ueAqNoRaFnPpXMadN1XBO2I6NunKa+fHbB7l8DbsYqdna8EOStzmY1QWn5+uXpzjvTok=
x-amz-request-id: 10H7A63QVNCWAYGY
Last-Modified: Tue, 02 Dec 2025 00:02:40 GMT
ETag: "b51bc2ef24dd293d0536fde4b2442c34"
x-amz-server-side-encryption: AES256
x-amz-meta-crlnumber: 1764633759280600767
Cache-Control: stale-if-error=600
Expires: Tue, 02 Dec 2025 00:37:39 GMT
x-amz-version-id: JaQCJB9IrrVwGA6AzA.F9CJA79VUdD51
CF-Cache-Status: HIT
Age: 271
Accept-Ranges: bytes
Vary: accept-encoding
CF-RAY: 9a76b2338f081ef8-VIE

hugogr45

pkernstock 2 more things Every time I send a message to myself to test if it’s working, it always goes to spam, and the last thing is when I send an email back to my test account, it does not receive it.

esackbauer

hugogr45
Your certificate was not created through mailcow it seems. Do you have a reverse proxy in front of mailcow?
It lacks the autodiscover and autoconfig hostnames, which is mandatory as per minimum DNS configuration.

For troubleshooting mail flow have a look at the postfix and dovecot logs.

hugogr45

esackbauer
I Fix the email going to spam i just need the inbound problem fixed

esackbauer

hugogr45
Your port 25 is not open. Firewall issue? Maybe your hoster/internet provider is blocking port 25?

mlcwuser

By the way, the PTR record is still wrong as well, assuming that the FQDN from the screenshot actually points to the IP of the Mailcow server, which it normally should do, given that the domain’s MX record points to that exact FQDN. 😉

hugogr45

mlcwuser I can’t put the PTR record it provided because Ionos does not provide the option to put a PTR record on the dns record

[unknown] Without paying $30 without knowledge that can i change that domains PTR record.

mlcwuser

hugogr45 That might also explain why port 25 is unavailable. Perhaps they do not want mail servers to be operated on these hosts!? Or, maybe you need to contact them to set the PTR record and open port 25.

In any case, to operate a mail server, you need a corresponding PTR record, and port 25 must be open for both outgoing and incoming traffic.

Double check in the Ionos admin panel to see if a firewall is active. If it is, make sure that port 25/tcp is allowed. Also check again whether you can add a PTR/Reverse DNS record anywhere in the admin panel. If not, contact Ionos and ask them to set it for you.

Should it indeed not be possible to set a PTR record and/or open port 25, then the provider or the particular plan you are using is simply not suitable for hosting a mail server.

DocFraggle

hugogr45 I can’t put the PTR record it provided because Ionos does not provide the option to put a PTR record on the dns record

Isn’t that what you want to do?

https://docs.ionos.com/cloud/network-services/cloud-dns/dcd-how-tos/reverse-dns/create-ptr-record

hugogr45

{“organization-name”:“Google Inc.”,“date-range”:{“start-datetime”:“2025-12-02T00:00:00Z”,“end-datetime”:“2025-12-02T23:59:59Z”},“contact-info”:“smtp-tls-reporting@google.com”,“report-id”:“2025-12-02T00:00:00Z_w-bhs.org”,“policies”:[{“policy”:{“policy-type”:“sts”,“policy-string”:[“version: STSv1”,“mode: enforce”,“max_age: 86400”,“mx: w-bhs.org”],“policy-domain”:“w-bhs.org”,“mx-host”:[“w-bhs.org”]},“summary”:{“total-successful-session-count”:0,“total-failure-session-count”:19},“failure-details”:[{“result-type”:“validation-failure”,“sending-mta-ip”:"",“receiving-ip”:“66.179.188.31”,“receiving-mx-hostname”:“mail.w-bhs.org”,“failed-session-count”:19}]}]}

well i got this for my smtp tls report