I have a very small scale personal mail server than I run on a VPS. Yesterday I migrated this, and changed the DNS records with the registrar (godaddy). Because of some limitations on the new host OS, I had to build the mail server software (courier) from source; it's something that's run without problems for several years and I haven't paid much attention to, so getting it all set up and configured took much more time and created much more stress than I intended. That provided me with a host of red herrings with regard to a problem on the SMTP port (25) -- this morning it was okay and received mail, but when I went to check it on sites like "MX tools" the response was very slow until this afternoon, when some of them started just plain timing out.1
This led me to start checking it myself, first using
openssl s_client to make sure STARTTLS was working, but that timed out. Plain old telnet timed out. The other ports courier was responsible for (imap-ssl, pop-ssl, and even smtp-ssl on 465) were fine -- CONNECT happened instantly.
Since then I've completely disabled the mail server. I.e., no courier software is running, period. I then started a very simple web server on port 25 and 26 to see what difference there is, and used
traceroute -T -p [N] cognitivedissonance.ca from here to check the connection.
The report for port 26, and any other port on the server, went fine. 10 or 11 hops from Toronto to San Franscisco in < 100 ms.
However, port 25 stops right after my router (192.x) -- I get 30
* * * and never reach the destination. So I tried
-w 300 -m 100, i.e.:
- Timeout each hop at 5 minutes.
- Give up after 100 hops.
Traceroute is still running after timing out on trying more than 20
* * *.
With regard to my own firewalls:
- Any TCP connection to the server is allowed from here.
- Currently the server's iptables (and ip6tables) are set completely open, i.e., just accept everything.
So this is not a firewall issue on the client or the server.
It is also not a dead port on the server, which I can connect to without issue via SSH.
lsof -i TCP:25 on the server shows a LISTEN. Further,
telnet localhost 25 or anything else on the server works instantaneously.
WHAT KIND OF CONSPIRACY IS THIS, LOL???
Has something propagated around such that my SMTP port has been blacklisted so badly in such a short time I cannot use it for any purpose? Or else it is just that first critical hop through my ISP? (I am going to re-enable the mail server and leave it on to see if it picks up mail, since I can still reach the remote system and use it on any other port.)
Is this last conjecture the most likely? If so, why would my major telecom ISP suddenly do this? Are there other possibilities? What can I do about this?
Note I've never used the domain for spam and no one is relaying through it either. As mentioned, this is a very small scale, harmless, personal mail server I've been using for years from a different VPS location (the provider of which is the same).
1. I had been assuming these sites did their analysis server-side, so if they couldn't reach 25, it was a universal issue and not just at my house -- I now think they in fact do it from your browser which is why they reported the same problem I found (see comments on the accepted answer).