Unable to send emails in Plesk with Imunify360: SMTP Error (-1): Connection to server failed

Plesk for Linux kb: technical

Applicable to:

Unable to send emails in Plesk. The following error is shown in webmail (Roundcube):

CONFIG_TEXT: SMTP Error (-1): Connection to server failed.
An email sent to any external mailbox may be bounced back with the following error:

CONFIG_TEXT: <externalmailbox@example.com>: mail for example.com loops back to myself
/var/log/plesk-roundcube/errors shows the following errors:

CONFIG_TEXT: PHP Warning: stream_socket_client(): unable to connect to ssl://localhost:465 (Connection refused) in /usr/share/psa-roundcube/vendor/pear/net_socket/Net/Socket.php on line 159
PHP Error: Connection refused (POST /roundcube/?_task=mail&_unlock=loading1617593106533&_framed=1&_lang=en_US&_action=send)
SMTP Error: Connection failed: Failed to connect socket: Connection refused in /usr/share/psa-roundcube/program/lib/Roundcube/rcube.php on line 1702 (POST /roundcube/?_task=mail&_unlock=loading1617593106533&_framed=1&_lang=en_US&_action=send)

The following error may appear in /var/log/maillog:

CONFIG_TEXT: postfix/smtp[10493]: connect to gmail-smtp-in.l.google.com[173.194.79.27]:25: Connection refused

CONFIG_TEXT: postfix/smtp[6237]: warning: host gmail-smtp-in.l.google.com[142.251.5.27]:25 greeted me with my own hostname example.com
postfix/smtp[6237]: warning: host gmail-smtp-in.l.google.com[142.251.5.27]:25 replied to HELO/EHLO with my own hostname example.com
Connected with the root user, it is possible to run telnet to the SMTP ports:

# telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Trying to perform a telnet to the SMTP ports with postfix, roundcube_sysuser or horde_sysuser fails:

# su -s /bin/bash -c "telnet localhost 25" roundcube_sysuser
Trying ::1...
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
The iptables contains restrictive SMTP rules from Imunify360 firewall:

# iptables -L -n
...
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_imunify360_SMTP all -- 0.0.0.0/0 0.0.0.0/0
...
Chain OUTPUT_imunify360_SMTP (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 25,587,465 owner UID match 0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 25,587,465 owner GID match 8
REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 25,587,465 reject-with icmp-port-unreachable

Imunify360 firewall only allows SMTP connections from the root user or mail group.

Log in to Plesk GUI
Go to Imunify360 > Settings > SMTP Traffic Management > Configure the Allow users with the following users: postfix,horde_sysuser,roundcube_sysuser > Click Save changes to apply the configuration: