0

I have two domains, a .com and a .net. The .com has a website hosted at google and uses gmail. The .net is a google compute engine with no associated mail accounts that runs its own webserver and uses postfix configured for outgoing mail only on port 587. I need an smtp relay for outgoing administrative email. I'm currently using another site I run as a stopgap measure, but I thought there ought to be a way to use one of google's smtp relays to do this. I've tried using aspmx2.googlemail.com but that doesn't seem to work (the relays that show up as MX records for the .com domain); but I get a network unreachable error:

postfix/smtp[2180]: ... relay=none, delay=30065, delays=30035/0.09/30/0, dsn=4.4.1, status=deferred (connect to aspmx2.googlemail.com[2607:f8b0:4001:c12::1a]:587: Network is unreachable)

I'm assuming the other relays in that group won't work either.

I've configured the smtp-relay service for the .com to allow relaying from the .net system.

Any help would be much appreciated.

update: removed relays which didn't work at all. Using smtp-relay.gmail.com does better, but still fails:

Aug  1 20:27:43 xblgx-ops postfix/master[30890]: daemon started -- version 3.1.0, configuration /etc/postfix
Aug  1 20:29:32 xblgx-ops postfix/pickup[30893]: BA3D73F79F: uid=1002 from=
Aug  1 20:29:32 xblgx-ops postfix/cleanup[30906]: BA3D73F79F: message-id=
Aug  1 20:29:32 xblgx-ops postfix/qmgr[30894]: BA3D73F79F: from=, size=418, nrcpt=1 (queue active)
Aug  1 20:29:32 xblgx-ops postfix/smtp[30910]: connect to smtp-relay.gmail.com[2607:f8b0:400e:c09::1c]:587: Network is unreachable
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: Untrusted TLS connection established to smtp-relay.gmail.com[74.125.195.28]:587: TLSv1.2 with cipher ECDHE-ECDSA-AES128-GCM-SHA256 (128/128 bits)
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: BA3D73F79F: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.49, delays=0.03/0.02/0.39/0.05, dsn=5.7.0, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.7.0 Mail relay denied [35.230.53.86]. Invalid credentials for relay for 550-5.7.0 one of the domains in: insidexblgx.internal, c.insidexblgx.internal, 550-5.7.0 xblgx-ops.c.insidexblgx.internal, xbiologix.net (as obtained from 550-5.7.0 HELO and MAIL FROM). 550-5.7.0 Email is being sent from a domain or IP address which isn't registered 550-5.7.0 in your G Suite account. Please login to your G Suite account and 550-5.7.0 verify that your sending device IP address has been registered within 550-5.7.0 the G Suite SMTP Relay Settings. For more information, please visit 550 5.7.0  https://support.google.com/a/answer/6140680#maildenied m11sm1647381ooe.3 - gsmtp (in reply to MAIL FROM command))
Aug  1 20:29:33 xblgx-ops postfix/cleanup[30906]: 3BBED3F7A0: message-id=
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: 3BBED3F7A0: from=, size=3849, nrcpt=1 (queue active)
Aug  1 20:29:33 xblgx-ops postfix/bounce[30913]: BA3D73F79F: sender non-delivery notification: 3BBED3F7A0
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: BA3D73F79F: removed
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: Untrusted TLS connection established to smtp-relay.gmail.com[74.125.195.28]:587: TLSv1.2 with cipher ECDHE-ECDSA-AES128-GCM-SHA256 (128/128 bits)
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: 3BBED3F7A0: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.45, delays=0/0/0.39/0.05, dsn=5.1.1, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser s2sm145038otd.5 - gsmtp (in reply to RCPT TO command))
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: 3BBED3F7A0: removed

The sending machine has IP 35.230.53.86 which shows on my google compute console VM as the proper IP, although a reverse dns shows it as 86.53.230.35.bc.googleusercontent.com. The IP has been explicitly allowed in the gsuite gmail settings for the .com domain:

Outbound from xbiologix.net
Allowed senders: Only addresses in my domains
Only accept mail from the specified IP addresses: Yes
Allowed IP addresses: xbiologix.net
Require SMTP Authentication: No
Require TLS encryption: No

Note that the domain xbiologix.net is the last domain in the log line complaining about invalid domains. But what does "my domains" mean? How does gsuite know what my domains are?

I modified the postfix main.cf to include:

smtp_helo_name = [35.230.54.86] xbiologix.net

But I now get:

Aug  1 21:17:51 xblgx-ops postfix/smtp[422]: connect to smtp-relay.gmail.com[2607:f8b0:400e:c09::1c]:587: Network is unreachable
Aug  1 21:17:51 xblgx-ops postfix/smtp[422]: 7B1383F79E: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.32, delays=0.02/0.02/0.28/0, dsn=4.4.2, status=deferred (lost connection with smtp-relay.gmail.com[74.125.195.28] while performing the HELO handshake)
1

Have a look at the error message:

Aug 1 20:29:33 xblgx-ops postfix/smtp[30910]: BA3D73F79F: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.49, delays=0.03/0.02/0.39/0.05, dsn=5.7.0, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.7.0 Mail relay denied [35.230.53.86]. Invalid credentials for relay for 550-5.7.0 one of the domains in: insidexblgx.internal, c.insidexblgx.internal, 550-5.7.0 xblgx-ops.c.insidexblgx.internal, xbiologix.net (as obtained from 550-5.7.0 HELO and MAIL FROM). 550-5.7.0 Email is being sent from a domain or IP address which isn't registered 550-5.7.0 in your G Suite account. Please login to your G Suite account and 550-5.7.0 verify that your sending device IP address has been registered within 550-5.7.0 the G Suite SMTP Relay Settings. For more information, please visit 550 5.7.0 https://support.google.com/a/answer/6140680#maildenied m11sm1647381ooe.3 - gsmtp (in reply to MAIL FROM command))

This behavior explained at the documentation Sending email from an instance:

... if you are familiar with G Suite and are already paying for a G Suite account that supports email, you can set up a relay service to send email through G Suite. Note that Gmail and G Suite enforce limits for email activity.

If you don't have a G Suite account or don't want to use G Suite or a third-party mail provider, you can set up your own email server on an instance using a non-standard port. You can choose any ephemeral port that isn't blocked by Compute Engine.

also, at the section Using standard email ports:

By default, Compute Engine allows outbound connections on all ports but port 25, which is blocked because of the risk of abuse. All other ports are open, including ports 587 and 465.

As you can see, accordingly to the documentation you can reach your goal in the 3 ways: configuring your own SMTP server, using your paid G Suite account, using paid 3rd party services.

In addition, you can try to configure relay via your existing smtp server based on Postfix that you mentioned above.

| improve this answer | |
  • I have read the docs multiple times. I have a gsuite account for the .COM comain, and in that account I have registered the IP for the .NET domain, which does not have an associated gsuite account. It is being accessed over port 587. – Gary Aitken Aug 4 at 14:12
  • You're able to use GSuite as a relay only for domains with associated GSuite account. For other domains you should use alternative services. Unfortunately, there's no exceptions. – Serhii Rohoza Aug 4 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.