Unable to send emails: Connection timed out or connection refused

Symptoms

• Unable to send emails from Plesk server to external servers.

• One several of the following error can be found in /var/log/maillog:

  • postfix/smtp[27746]: E3B24978700: to=<example@gmail.com>, relay=none, delay=537, delays=446/0.02/91/0, dsn=4.4.1, status=deferred (connect to example.com[203.0.113.2]:25: Connection timed out)

  • postfix/smtp[15684]: connect to example.com[203.0.113.2]:25: Connection timed out

  • qmail: 1491974064.856278 delivery 8214: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)

  • postfix/smtp[27746]: E3B24978700: to=<john.doe@example.com>, relay=none, delay=537, delays=446/0.02/91/0, dsn=4.4.1, status=deferred (connect to example.com[203.0.113.2]:25: Connection refused)

• It is possible to send an email from external server to Plesk serve and between mailboxes created in Plesk (locally).

• Unable to connect to the 25 port of the remote mail server from the Plesk server with telnet. One of the following errors is shown:

  • # telnet mailserver.example.com 25
    Trying 203.0.113.2...
    telnet: connect to address 203.0.113.2: No route to host
    Trying 2607:f8b0:4002:c03::1b...
    telnet: connect to address 2001:db8:f61:a1ff:0:0:0:80 Network is unreachable
    telnet: Unable to connect to remote host: Network is unreachable

  • # telnet mailserver.example.com 25
    Trying 203.0.113.2...
    telnet: connect to address 203.0.113.2: Connection timed out

• traceroute command to port 25 shows the following output:

  # traceroute -T -p 25 mailserver.example.com
  traceroute to mailserver.example.com (203.0.113.3), 30 hops max, 60 byte packets
  1 example.com (203.0.113.2) 0.055 ms 0.015 ms 0.012 ms
  2 example2.com (203.0.113.3) 0.181 ms example2.com (203.0.113.4) 0.170 ms example2.com (203.0.113.5) 0.168 ms
  3 example3.com (203.0.113.5) 0.925 ms 1.105 ms example3.com (203.0.113.6) 1.380 ms
  4 * * *

• External connections via port 25 from Plesk server to external server are restricted:

  # nmap -p25 -sTU mailserver.example.com
  PORT STATE SERVICE
  25/tcp filtered smtp

• Firewall on the Plesk server does not restrict connections to port 25.

Cause

Port 25 is blocked by internet provider or Cloud Service.

Resolution

Contact network administrator or internet service provider (ISP) to allow outgoing connections to 25 TCP port.

If any of Cloud Services are used, it is needed to check firewall on the Cloud Service’s side.

For Google Cloud, Amazon (AWS) outbound connections to port 25 are blocked by default to prevent outgoing spam. To resolve the issue with port 25 on these Cloud Services refer to the following pages:

• AWS: How do I remove the throttle on port 25 from my EC2 instance
• Google Cloud: Sending Email from an Instance
• For Microsoft Azure, use a third party service like SendGrid. Create a SendGrid account and configure Postfix to use SendGrid as a relay.

Vultr blocks port 25 but can unlock it: https://www.vultr.com/docs/what-ports-are-blocked

Azure blocks port 25 for new users and may unblock it, but it is unlikely: https://blogs.msdn.microsoft.com/mast/2017/11/15/enhanced-azure-security-for-sending-emails-november-2017-update/