Unable to send emails using Plesk local mail server: Connection timed out or connection refused

Symptoms

• Unable to send emails from Plesk server to external servers.

• One of the following errors may be found in /var/log/maillog:

  Postfix

  • CONFIG_TEXT: postfix/smtp[27746]: E3B24978700: to=john.doe@example.com, relay=none, delay=537, delays=446/0.02/91/0, dsn=4.4.1, status=deferred (connect to example.com[203.0.113.2]:25: Connection timed out)

  • CONFIG_TEXT: postfix/smtp[15684]: connect to example.com[203.0.113.2]:25: Connection timed out

  • CONFIG_TEXT: postfix/smtp[27746]: E3B24978700: to=john.doe@example.com, relay=none, delay=537, delays=446/0.02/91/0, dsn=4.4.1, status=deferred (connect to example.com[203.0.113.2]:25: Connection refused)

  QMail

  • CONFIG_TEXT: qmail: 1491974064.856278 delivery 8214: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)

• Local mail delivery between domains in Plesk works;

• Outbound connections via port 25 from Plesk server are restricted:

  # telnet example.com 25
  Trying 203.0.113.2...
  telnet: connect to address 203.0.113.2: Connection refused

• Firewall on the Plesk server does not restrict connections to port 25.

Cause

Port 25 is blocked for outbound connections.
Sometime internet service providers (ISP) can restrict outbound/inbound connections on port 25 due to security reasons. Also, Google Cloud platform has such port blocked as a default and services like G Suite should be used to send mail.

Resolution

Note: Networking tasks and the local firewall configuration are the activities that should be handled by Plesk server administrator, as Plesk is a part of the server infrastructure and relays on local network settings.

Here are general troubleshooting steps:

1. Make sure that local firewall does not causes the issue. Stop the service temporary and try to send mail.

2. If the issue still persists, it means that the cause is outside of the Plesk server. In that case, contact network administrator and discuss if port 25 can be added to allowed ones or not.

   If any of Cloud Services are used, it is needed to check firewall on the Cloud Service’s side.

   • For Google Cloud, Amazon (AWS) outbound connections to port 25 are blocked by default to prevent outgoing spam. To resolve the issue with port 25 on these Cloud Services refer to the following pages:

     • AWS: How do I remove the throttle on port 25 from my EC2 instance
     • Google Cloud: Sending Email from an Instance

   • For Microsoft Azure, use a third party service like SendGrid. Create a SendGrid account and configure Postfix to use SendGrid as a relay.
     Azure blocks port 25 for new users: https://blogs.msdn.microsoft.com/mast/2017/11/15/enhanced-azure-security-for-sending-emails-november-2017-update/

   • Vultr blocks port 25 but can unlock it: https://www.vultr.com/docs/what-ports-are-blocked

Additional information

How to configure Postfix to send email from a Google Cloud server using SendGrid?
How to configure MailEnable to send emails on Google Cloud Platform instance?