Test email sending with TLS (587 port)

Cant send mail with TLS (587 port)

Even though it is possible to send messages using port 25 configuration, it is not possible to send email with TLS activated port 587.

Step 1 How to Test it command line (simulate the issue).

root@email-b6c7d4c7f-5t87l:/var/log# openssl s_client -connect email:587 -starttls smtp
CONNECTED(00000003)
depth=0 C = US, ST = Oregon, L = Portland, O = lsf, OU = Org, CN = mail.copper.test.lk
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = Oregon, L = Portland, O = lsf, OU = Org, CN = mail.copper.test.lk
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Oregon/L=Portland/O=lsf/OU=Org/CN=mail.copper.test.lk
   i:/C=US/ST=Oregon/L=Portland/O=lsf/OU=Org/CN=mail.copper.test.lk
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFrDCCA5SgAwIBAgIJAN+f6wFnoARaMA0GCSqGSIb3DQEBCwUAMGsxCzAJBgNV
1kcNTDFiDeY0F8m/L4C9wUyYA5Ebi5tJGc/Gz4AcAFcgF1Kxt9I3//rQl8Kp0X6D
djw8jiiXJMI82MGgUvJqYvYzAXwYin7aed+7PDkbC7hljlnJXEsnAMBROvQ++zHX
1dAf5AxeMj+YDFm6kiX/lg==
-----END CERTIFICATE-----
subject=/C=US/ST=Oregon/L=Portland/O=lsf/OU=Org/CN=mail.copper.test.lk
issuer=/C=US/ST=Oregon/L=Portland/O=lsf/OU=Org/CN=mail.copper.test.lk
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2559 bytes and written 302 bytes
Verification error: self signed certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 971757A8240C0495552B360CCFACF8A2FBF00411A5B30605100F19E54D1722E9
    Session-ID-ctx: 
    Master-Key: 9380516DC2C86E8E67EABDB62A256DBEE2290A24D515646008C854DB737BB2AEA3C62E35AC6C484EB5A71814B1ED8AC4
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 5e 8b 3a 7a 5f 7f 2f 21-9a 8c e4 44 0f 08 28 dd   ^.:z_./!...D..(.
    0010 - bb fe 97 6d b8 04 2f 6c-4e 4a d9 86 b5 34 8e ee   ...m../lNJ...4..
    0020 - 86 df f3 f8 b4 98 9d 67-62 00 54 94 59 57 ad 48   .......gb.T.YW.H
    0030 - 58 50 d8 66 72 c3 04 e7-cb 8e 74 0a db da e6 9b   XP.fr.....t.....
    0040 - 06 d6 d3 db f2 6e f0 32-e0 a0 18 a0 d4 db d6 f1   .....n.2........
    0050 - 4d 97 fc 51 03 2e bb 20-1e 52 4e c6 41 34 38 32   M..Q... .RN.A482
    0060 - fb d9 7a 8d 01 af a5 45-5c 69 9a 93 87 fc af 27   ..z....E\i.....'
    0070 - e1 97 0b 77 f1 04 dd 15-65 15 3a 0a d3 dd bb 3c   ...w....e.:....<
    0080 - 5f de a4 23 4b 3e 4b 2a-d0 41 12 f4 04 83 7c 3b   _..#K>K*.A....|;
    0090 - a0 51 11 2b 71 69 a5 d1-f8 b6 26 51 2e fe 2b 1c   .Q.+qi....&Q..+.
    00a0 - 84 e9 6c 74 59 4c 46 11-a5 a9 fe c0 f1 b4 b2 46   ..ltYLF........F

    Start Time: 1553159047
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: yes
---
250 SMTPUTF8
mail from:test@copper.test.lk
250 2.1.0 Ok
rcpt to:test@copper.test.lk
554 5.7.1 <unknown[10.1.0.1]>: Client host rejected: Access denied
quit
221 2.0.0 Bye
closed
root@email-b6c7d4c7f-5t87l:/var/log# 

Step 2 Check the submission port.

grep submission /etc/services

Step 3 Check the postfix log file

Mar 21 08:47:22 email-b6c7d4c7f-5t87l postfix/submission/smtpd[395]: connect from unknown[10.1.7.188]
Mar 21 08:47:22 email-b6c7d4c7f-5t87l postfix/submission/smtpd[395]: NOQUEUE: reject: RCPT from unknown[10.1.7.188]: 554 5.7.1 <unknown[10.1.7.188]>: Client host rejected: Access denied; from=<test@copper.test.lk> to=<test@copper.test.lk> proto=ESMTP helo=<localhost>
Mar 21 08:47:22 email-b6c7d4c7f-5t87l postfix/submission/smtpd[395]: disconnect from unknown[10.1.7.188] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 quit=1 commands=5/7
Mar 21 08:50:42 email-b6c7d4c7f-5t87l postfix/anvil[398]: statistics: max connection rate 1/60s for (submission:10.1.7.188) at Mar 21 08:47:22
Mar 21 08:50:42 email-b6c7d4c7f-5t87l postfix/anvil[398]: statistics: max connection count 1 for (submission:10.1.7.188) at Mar 21 08:47:22
Mar 21 08:50:42 email-b6c7d4c7f-5t87l postfix/anvil[398]: statistics: max cache size 1 at Mar 21 08:47:22

Step 4 check the dovecot log file

Mar 21 08:48:28 imap-login: Info: Login: user=<test>, method=PLAIN, rip=10.1.7.188, lip=10.1.7.185, mpid=404, TLS, session=<pX9RzZaECtYKAQe8>
Mar 21 08:48:28 imap(test): Info: Logged out in=54 out=768
Mar 21 08:50:02 auth: Error: ldap_unbind
Mar 21 08:50:02 auth: Error: ldap_free_connection 1 1
Mar 21 08:50:02 auth: Error: ldap_send_unbind
Mar 21 08:50:02 auth: Error: ldap_free_connection: actually freed

Step 5

According to observation looks like postfix has rejected client requests when comes from the port 587. Then checked the submission has enabled in master.cf file. It should have following configuration.

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Step 5

Now checked mail sending with port number 25.

openssl s_client -connect email:25 -starttls smtp

    0090 - a1 d2 a7 4d e8 ed 1f 79-b7 8c ba a9 a3 0f 7a 2c   ...M...y......z,
    00a0 - 67 2b af f8 44 fc 61 c2-7f a9 7f 79 af fa e7      g+..D.a....y...
    00b0 - <SPACES/NULS>

    Start Time: 1553160437
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: yes
---
250 SMTPUTF8
mail from:test@copper.test.lk
250 2.1.0 Ok
rcpt to:test@copper.test.lk
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
subject:Test from 25
body:test form 25
.
250 2.0.0 Ok: queued as A8C1C3812E0

It was also success. Then it is clear issue comes only when sending mail using port number 587.

check the submission port

grep submission /etc/services

Email related issues and solutions.

https://support.plesk.com/hc/en-us/sections/115000422433-Mail

---