I have a Debian8 server running exim4 that sends outgoing mail by smarthost through NameCheap's mail.privateemail.com smtp server - or at least it use to. After a recent update, the server no longer accepts connections on port 25. I've reconfigured exim to use port 587 but can't send any mail.
The problem appears to occur during the STARTTLS handshaking. Initial connection succeeds, the server sends its 220 response, the exim client sends its ELHO command, and the server offers the 250 STARTTLS option. At that point, instead of replying with STARTTLS and establishing the secure connection, exim begins to send the message headers. To this the server sends a 530 "Must issue a STARTTLS command first" and the message delivery attempt aborts. Here is a snippet from the debug output from forcing delivery of a frozen message with
exim -d -M:
Transport port=25 replaced by host-specific port=587 Connecting to mail.privateemail.com [18.104.22.168]:587 ... connected waiting for data on socket read response data: size=32 SMTP<< 220 PrivateEmail.com Mail Node 22.214.171.124 in hosts_avoid_esmtp? no (option unset) SMTP>> EHLO efserver.hellonull.com waiting for data on socket read response data: size=22 SMTP<< 250-STARTTLS 250 OK 126.96.36.199 in hosts_require_tls? no (option unset) 188.8.131.52 in hosts_avoid_pipelining? no (option unset) not using PIPELINING 184.108.40.206 in hosts_require_auth? no (option unset) SMTP>> MAIL FROM:<> waiting for data on socket read response data: size=41 SMTP<< 530 Must issue a STARTTLS command first ok=0 send_quit=1 send_rset=1 continue_more=0 yield=0 first_address is not NULL SMTP>> QUIT
Everything was working previously on port 25. Additionally, I am able to send outgoing mail using IceDove configured to use the same server, port, and STARTTLS. Can anyone explain why exim seems to be ignoring the STARTTLS offering from the server?