Outbound SMTP (Transactional Email) Stopped Working - Invalid login: 535 Authentication failed

[wmlutz]

I'm using Cloudron v8.2.4, GhostCMS v4.107.0. On an AWS EC2 instance.

One of my users recently noticed that the transactional emails were not working. I had made no changes on my end. I found this in the logs when attempting to use the magic-link feature:

Mar 26 09:46:33 Failed to send email. Reason: Invalid login: 535 Authentication failed.
Mar 26 09:46:33 Failed to send email. Reason: Invalid login: 535 Authentication failed.
Mar 26 09:46:33 "Please see https://ghost.org/docs/config/#mail for instructions on configuring email."
Mar 26 09:46:33 "Please see https://ghost.org/docs/config/#mail for instructions on configuring email."
Mar 26 09:46:33
Mar 26 09:46:33
Mar 26 09:46:33 ----------------------------------------
Mar 26 09:46:33 ----------------------------------------
Mar 26 09:46:33 EAUTH
Mar 26 09:46:33 EAUTH
Mar 26 09:46:33 Error: Invalid login: 535 Authentication failed
Mar 26 09:46:33 Error: Invalid login: 535 Authentication failed
Mar 26 09:46:33 baa90ed0-0a48-11f0-adce-ad4eb2a5961f
Mar 26 09:46:33 baa90ed0-0a48-11f0-adce-ad4eb2a5961f
Mar 26 09:46:33 [2025-03-26 13:46:33] ERROR "POST /members/api/send-magic-link/" 500 349ms
Mar 26 09:46:33 [2025-03-26 13:46:33] ERROR Failed to send email. Reason: Invalid login: 535 Authentication failed.
Mar 26 09:46:33 [2025-03-26 13:46:33] INFO "GET /members/api/integrity-token/" 200 1ms
Mar 26 09:46:33 at Readable.push (node:internal/streams/readable:245:10)
Mar 26 09:46:33 at Readable.push (node:internal/streams/readable:245:10)
Mar 26 09:46:33 at SMTPConnection.<anonymous> (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:554:26)
Mar 26 09:46:33 at SMTPConnection.<anonymous> (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:554:26)
Mar 26 09:46:33 at SMTPConnection._actionAUTHComplete (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:1586:34)
Mar 26 09:46:33 at SMTPConnection._actionAUTHComplete (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:1586:34)
Mar 26 09:46:33 at SMTPConnection._formatError (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:807:19)
Mar 26 09:46:33 at SMTPConnection._formatError (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:807:19)
Mar 26 09:46:33 at SMTPConnection._onData (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:772:14)
Mar 26 09:46:33 at SMTPConnection._onData (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:772:14)
Mar 26 09:46:33 at SMTPConnection._onSocketData (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:195:44)
Mar 26 09:46:33 at SMTPConnection._onSocketData (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:195:44)
Mar 26 09:46:33 at SMTPConnection._processResponse (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:991:20)
Mar 26 09:46:33 at SMTPConnection._processResponse (/home/cloudron/ghost/versions/5.109.0/node_modules/nodemailer/lib/smtp-connection/index.js:991:20)
Mar 26 09:46:33 at TLSSocket.emit (node:events:517:28)
Mar 26 09:46:33 at TLSSocket.emit (node:events:517:28)
Mar 26 09:46:33 at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23)
Mar 26 09:46:33 at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23)
Mar 26 09:46:33 at addChunk (node:internal/streams/readable:335:12)
Mar 26 09:46:33 at addChunk (node:internal/streams/readable:335:12)
Mar 26 09:46:33 at createMailError (/home/cloudron/ghost/versions/5.109.0/core/server/services/mail/GhostMailer.js:81:12)
Mar 26 09:46:33 at createMailError (/home/cloudron/ghost/versions/5.109.0/core/server/services/mail/GhostMailer.js:81:12)
Mar 26 09:46:33 at readableAddChunk (node:internal/streams/readable:308:9)
Mar 26 09:46:33 at readableAddChunk (node:internal/streams/readable:308:9)
Mar 26 09:46:33 BoxError: Not enough disk space for backup. Needed: 1.54GB Available: 1.26GB
Mar 26 09:46:33 BoxError: Not enough disk space for backup. Needed: 1.55GB Available: 1.22GB
Mar 26 09:46:33 }
Mar 26 09:46:33 }

Looking at my email settings this is what I've got:

Clicking on the domain

I reset my password in Mailgun in my outbound email settings, I know it has the right username and password, but I'm still getting the same error. Can anyone help me figure this one out? I tried following the docs, but they are hard to follow.

[jdaviescoates]

@wmlutz said in Outbound SMTP (Transactional Email) Stopped Working - Invalid login: 535 Authentication failed:

Postmark looks way overpowered for what I need.

@wmlutz Ghost requires Mailgun anyway

One thing that's tripped me up in the past (especially after moving server): you need to whitelist your IP in Mailgun, see https://help.mailgun.com/hc/en-us/articles/360012244474-IP-Allowlist

Have you already done that? If not go here https://app.mailgun.com/settings/ip-access-management to add your server's IP.

Also be sure to update the Email address of your app here too to match your support@ address (I can't remember exactly why I needed to do this, but when I moved it from https://bridport.news to https://westdorset.news that was one of the things I ended up needing to do):

[joseph]

@wmlutz iirc for mailgun, there are two types of accounts - eu and non-eu. they use different smtp servers - smtp.mailgun.org or smtp.eu.mailgun.org . Could this be it?

[wmlutz]

@joseph it worked fine a few weeks ago. I'm US based and haven't used any of the eu accounts/servers.

[joseph]

@wmlutz can you test using swaks cli? https://documentation.mailgun.com/docs/mailgun/user-manual/sending-messages/#send-via-smtp . swaks is already installed on cloudron server.

[wmlutz]

OK, cool I just ran this:

swaks --auth \
       --server smtp.mailgun.org \
       --au postmaster@mail.tjspto.org \
       --ap PASSWORD \
       --to my-personal-email@gmail.com \
       --h-Subject: "Hello" \
       --body 'Testing some Mailgun awesomness!'
=== Trying smtp.mailgun.org:25...
*** Error connecting to smtp.mailgun.org:25:
***     IO::Socket::INET: connect: timeout
root@17221886-0501-4fa4-8aeb-8a3025067e25:/# 

Does that help?

[wmlutz]

I also tried the other ports:

root@17221886-0501-4fa4-8aeb-8a3025067e25:/# swaks --auth \
       --server smtp.mailgun.org:465 \
       --au postmaster@mail.tjspto.org \
       --ap PASSWORD \
       --to my-personal-email@gmail.com \
       --h-Subject: "Hello" \
       --body 'Testing some Mailgun awesomness!'
=== Trying smtp.mailgun.org:465...
=== Connected to smtp.mailgun.org.
<** Timeout (30 secs) waiting for server response
 -> QUIT
<** HTTP/1.1 400 Bad Request
<** Content-Type: text/plain; charset=utf-8
<** Connection: close
<** 
*** Remote host closed connection unexpectedly.
root@17221886-0501-4fa4-8aeb-8a3025067e25:/# swaks --auth \
       --server smtp.mailgun.org:587 \
       --au postmaster@mail.tjspto.org \
       --ap PASSWORD \
       --to my-personal-email@gmail.com \
       --h-Subject: "Hello" \
       --body 'Testing some Mailgun awesomness!'
=== Trying smtp.mailgun.org:587...
=== Connected to smtp.mailgun.org.
<-  220 Mailgun Influx ready
 -> EHLO 17221886-0501-4fa4-8aeb-8a3025067e25
<-  250-dc25da1f3901
<-  250-AUTH PLAIN LOGIN
<-  250-SIZE 52428800
<-  250-8BITMIME
<-  250-SMTPUTF8
<-  250-PIPELINING
<-  250 STARTTLS
 -> AUTH LOGIN
<-  334 VXNlcm5hbWU6
 -> cG9zdG1hc3RlckBtYWlsLnRqc3B0by5vcmc=
<-  334 UGFzc3dvcmQ6
 -> NjIxNWJhOGYyZTZmMDFkZGE0MjAyZTZhYTEyMjM5MjQtZjYyMDIzNzQtMzNjYjQzZWY=
<** 535 Authentication failed
 -> AUTH PLAIN AHBvc3RtYXN0ZXJAbWFpbC50anNwdG8ub3JnADYyMTViYThmMmU2ZjAxZGRhNDIwMmU2YWExMjIzOTI0LWY2MjAyMzc0LTMzY2I0M2Vm
*** Remote host closed connection unexpectedly.

[joseph]

@wmlutz try port 587 . usually that is the mail submission port .

[wmlutz]

Roger that. Does this help?

root@17221886-0501-4fa4-8aeb-8a3025067e25:/# swaks --auth \
       --server smtp.mailgun.org:587 \
       --au postmaster@mail.tjspto.org \
       --ap PASSWORD \
       --to EMAIL \
       --h-Subject: "Hello" \
       --body 'Testing some Mailgun awesomness!'
=== Trying smtp.mailgun.org:587...
=== Connected to smtp.mailgun.org.
<-  220 Mailgun Influx ready
 -> EHLO 17221886-0501-4fa4-8aeb-8a3025067e25
<-  250-bc2e5756fbc9
<-  250-AUTH PLAIN LOGIN
<-  250-SIZE 52428800
<-  250-8BITMIME
<-  250-SMTPUTF8
<-  250-PIPELINING
<-  250 STARTTLS
 -> AUTH LOGIN
<-  334 VXNlcm5hbWU6
 -> cG9zdG1hc3RlckBtYWlsLnRqc3B0by5vcmc=
<-  334 UGFzc3dvcmQ6
 -> NjIxNWJhOGYyZTZmMDFkZGE0MjAyZTZhYTEyMjM5MjQtZjYyMDIzNzQtMzNjYjQzZWY=
<** 535 Authentication failed
 -> AUTH PLAIN AHBvc3RtYXN0ZXJAbWFpbC50anNwdG8ub3JnADYyMTViYThmMmU2ZjAxZGRhNDIwMmU2YWExMjIzOTI0LWY2MjAyMzc0LTMzY2I0M2Vm
*** Remote host closed connection unexpectedly.
root@17221886-0501-4fa4-8aeb-8a3025067e25:/# 

[luckow]

@wmlutz this looks like a typo in your credentials

<** 535 Authentication failed

[wmlutz]

@luckow I verified and re-verified that I have the credentials correct (Mailgun makes you copy it to the clipboard when you make new credentials). Plus the fact that it worked a week ago, and not now . . . that would hint that it's not a credential typo right?

[luckow]

@wmlutz I have no idea about Mailgun. But IMHO it's ultimately just a smtp endpoint. Try to find out if - say - a Thunderbird smtp setting works. If you can send emails with your email client, everything should work with your Cloudron instance. If not (with the Cloudron instance), you have found an error.

[wmlutz]

Is there another way to do transactional emails from Ghost that doesn't involve going back to mailgun? Can Cloudron send from a different email address?

[robi]

@wmlutz search the forum for a gmail integration

[crazybrad]

@wmlutz Checkout Postmarkapp.com. They do a great job as long as you separate transactional from broadcast (marketing) messages. I can't speak about Ghost email config, but all you need is their endpoint, port and username/password which looks like Ghost supports. Suggestion: establish a sender signature by adding DKIM, Return-Path DNS records and you can send from any email address on your domain.

[wmlutz]

@crazybrad thanks for the suggestion. I'm running a little 350 person newsletter for the parent-teacher organization in my town. Postmark looks way overpowered for what I need. There has to be something fundamentally wrong with my GhostCMS and Cloudron setup. @joseph can you point me in the right direction on how to keep troubleshooting?

[jdaviescoates]

@wmlutz said in Outbound SMTP (Transactional Email) Stopped Working - Invalid login: 535 Authentication failed:

Postmark looks way overpowered for what I need.

@wmlutz Ghost requires Mailgun anyway

One thing that's tripped me up in the past (especially after moving server): you need to whitelist your IP in Mailgun, see https://help.mailgun.com/hc/en-us/articles/360012244474-IP-Allowlist

Have you already done that? If not go here https://app.mailgun.com/settings/ip-access-management to add your server's IP.

Also be sure to update the Email address of your app here too to match your support@ address (I can't remember exactly why I needed to do this, but when I moved it from https://bridport.news to https://westdorset.news that was one of the things I ended up needing to do):

[joseph]

@wmlutz not sure but looks like you can maybe you can reach out to mailgun support and check why it's not working. Maybe something is not activated on their side or the account is not completely active .

[crazybrad]

@wmlutz It's not a matter of scope. Even sending 10 emails could trip the spam filters. And your comment about a newsletter indicates "broadcast" (a/k/a marketing) not transactional. If you are sending the same email to 350 people in the same batch, then this is considered "broadcast"/marketing. It's not my definition, it's how inbox providers see your domain/traffic. You need to use the correct type of traffic or you will eventually be blocked/banned. It doesn't matter about Cloudron config, Mailgun vs. Postmark. Move your traffic to a platform that sends via outbound marketing streams.

[wmlutz]

@jdaviescoates got it! It was the IP allowlist.

Last week I noticed a cloudron error that said:

Server is running out of disk space 2:30 PM

One or more file systems are running out of space. Please increase the disk size at the earliest.

/dev/root is at 97% capacity.

So I attempted to make my EC2 instance bigger (didn't solve the space problem, but that's for another thread). It did however change my IP address. I added the new IP to Mailgun and swaks started working properly in a few minutes.

Side note: @crazybrad I think we're mixing up marketing/bulk and transactional. I use transactional for my ghostcms so I can keep things behind an auth wall, trying to keep kids safe. My parents/members use it rarely, it's not even worth $12/mo compared to mailgun's transactional email cost which is cents/mo.

Thanks to all for the help.

[jdaviescoates]

@wmlutz said in Outbound SMTP (Transactional Email) Stopped Working - Invalid login: 535 Authentication failed:

@jdaviescoates got it! It was the IP allowlist.

Glad to be of assistance

@wmlutz said in Outbound SMTP (Transactional Email) Stopped Working - Invalid login: 535 Authentication failed:

mailgun's transactional email cost which is cents/mo.

I don't think I've ever paid anything yet as I've not yet gone over the 1000 free messages a month or whatever it is...