Selective „Connection timed out“ for outbound smtp

thebub

Hi,
I recently ran into a problem where postfix is unable to deliver mails to selective external domains. It is not a general issue, as some domains are perfectly fine and some are not.

connect to mail-relay.gross-gerau.de[91.26.116.55]:25: Connection timed out)

I tried delivering to GMail which worked perfectly fine. Others don’t.

I attempted to analyze and the interesting part is that on the Docker host I can telnet into the IP and port (25) in question. I‘m hosting at Hetzner (for a long time now) and I never saw that issue.

Any suggestions how to debug the issue inside the postfix container?

Thanks!

esackbauer

That could be anything. Local firewall on your docker host, Docker itself (have you tried to connect from within the postfix container to that IP?)
Or misconfiguration (e.g. of a sender dependent transport or in postfix config files)
Have you tried your telnet session with proper commands like EHLO etc.?

thebub

On the host I tried the following:

thebub@host:~$ dig MX gross-gerau.de
[...]
gross-gerau.de.         3513    IN      MX      100 mail-relay.gross-gerau.de.

thebub@host:~$ dig A mail-relay.gross-gerau.de
[...]
mail-relay.gross-gerau.de. 3438 IN      A       91.26.116.55

thebub@host:~$ telnet mail-relay.gross-gerau.de 25
Trying 91.26.116.55...
Connected to mail-relay.gross-gerau.de.
Escape character is '^]'.
220 mail-relay.gross-gerau.de ESMTP
EHLO mail.foobar.com
250-mail-relay.gross-gerau.de
250-8BITMIME
250-SIZE 51380224
250 STARTTLS
QUIT
221 mail-relay.gross-gerau.de
Connection closed by foreign host.

On the postfix container I tried:

root@postfix-mailcow:~$ dig MX gross-gerau.de
[...]
gross-gerau.de.         3513    IN      MX      100 mail-relay.gross-gerau.de.

root@postfix-mailcow:~$ dig A mail-relay.gross-gerau.de
[...]
mail-relay.gross-gerau.de. 3438 IN      A       91.26.116.55

root@postfix-mailcow:~$ telnet mail-relay.gross-gerau.de 25
Trying 91.26.116.55...telnet: Unable to connect to remote host: Connection timed out

I just tried to connect to the GMail SMTP: It vailed via IPv4 and only succeeded via IPv6.
That explains the “selective” part. If the receiving server is accessible via IPv4 only it will fail and if it is also reachable via IPv6 it succeeds…

root@postfix-mailcow:~$ telnet gmail-smtp-in.l.google.com 25
Trying 142.250.147.27...
Connection failed: Connection timed out
Trying 2a00:1450:4025:c01::1b...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP 4fb4d7f45d1cf-654536d14fdsi2130279a12.281 - gsmtp
EHLO mail.foobar.com
250-mx.google.com at your service, [2a01:4f8:c2c:dc64::1]
250-SIZE 157286400
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-CHUNKING
250 SMTPUTF8
QUIT
221 2.0.0 closing connection 4fb4d7f45d1cf-654536d14fdsi2130279a12.281 - gsmtp
Connection closed by foreign host.

thebub

The issue was an incomplete switch from the ipv6nat-mailcow to native docker ipv6 support.