Website needs to send emails to cloudron server

[girish]

@AartJansen port 25 is not the correct port to send email. This is for exchange of mail between mail servers.

Can you try with encryption - port 587 (TLS) or port 465 (SSL) ?

I misread that UI. Unfortunately, the settings are totally confusing. Port 587 is STARTTLS aka opportunistic TLS. Port 465 is always TLS . Generally, it doesn't make sense to choose between SSL and TLS like in the UI I guess use TLS there.

I am not sure what "Auto TLS" means above, I guess you have to enable it?

Also, on Cloudron, you must always have authentication. So turn on the last Authentication checkbox as well.

[AartJansen]

I think port 25 works ok, without authetication, for mail domains that the server hosts, as PHPMailer acts as a SMTP server sending mail to another SMTP server. And because its whitelisted the senders domain being one thats hosted on cloudron gets a pass. (Even though the logs indicate an address postmaster@... that I don't think exists), and the website people say they are not using.
Is there a default postmaster@ account for sending NDR's etc ?
The problem is, they want to also send the email to customer this way and cloudron wont relay.

[girish]

@AartJansen said in Website needs to send emails to cloudron server:

The problem is, they want to also send the email to customer this way and cloudron wont relay.

Right, cloudron won't relay mail that is coming in via port 25. port 25 is the port for incoming mail. It will only relay emails that are being sent via submisson port . See also https://kinsta.com/blog/smtp-port/

(Your observation is correct otherwise. Cloudron will accept mails on port 25 from another server but these won't be relayed. Cloudron's relay is meant for mails that it sends out)

[AartJansen]

Thanks, what about that mysterious reference to postmaster@mydomain ? I think its their end using it, if I read the logs correctly. I have turned on masquerading for that domain, but would that help if the postmaster mail address is non-existent ?

[girish]

@AartJansen not sure, I am a bit lost of the specifics of your setup. An external website (WordPress) wants to send email to a mailbox hosted on Cloudron mail server. This external website behaves as a mail server of it's own and sends via port 25 and also has the appropriate DNS records for whitelisting it. I assume Cloudron mail server also has that mailbox created. Did I get this right? What is the issue?

[AartJansen]

Yes, thats correct.
The issue is that the website also wants to send an email to the customer as a confirmation of their purchase. ie buyer@gmail.com and is sending it to cloudron server for delivery. I just read the kinsta link you provided, thanks for that, I did not realise port 465 was "no longer official" and 587 was the preferred port.

[girish]

@AartJansen Is there a reason the website is sending email to buyer@gmail.com via Cloudron ? Why is it not sending to gmail directly?

But, if you really want to get Cloudron to send this mail to buyer@gmail.com, then the website has to use the credentials of a mailbox on Cloudron and send via port 587. Cloudron mail server does not relay email unauthenticated mail.

What I mean is: create a mailbox called website@ in Cloudron. Assign owner to this mailbox. You can create app password that will work only for mailboxes in the Profile -> App Password -> Mail client. Then use website@ and password in the website to send mails on port 587 via STARTTLS

[AartJansen]

Thank you @girish those instructions worked well!

[AartJansen]

Just as a follow up, another webhost for another site (same server) just got me to add the ip of their sending server to the SPF record, they were getting similar errors, and didn't want to use 587 / authentication.
So the spf record now looks like

v=spf1 a:my.friendwholesale.co.nz ip4:103.248.189.217 +a:my.friendwholesale.co.nz ~all

Seems weird to have a: and +a: with the same domain, it passes the mxtoolbox spf test

[girish]

@AartJansen '+' is the default qualifier. So, it is redundant in +a:my.friendwholesale.co.nz . You can remove it.