Continuing the discussion from Digital Ocean is blocking outgoing mail!: It seems that Digital Ocean is blocking out bound SMTP traffic for at least some customers. My guess is that soon you’ll have to jump through hoops to be able to access a remote SMTP port. Simple solution: Mailgun, Sendgrid, and Sparkpost all accept TLS traffic on port 2525. I propose these changes to discourse-setup changing default SMTP port for those services to 2525. adding a test (e.g., nc -z -w5 smtp.mailgun.org 25) to see if the chosen SMTP port is open Why those 3 services services? They’re the ones that discourse-setup currently knows about and recommends smtp_user_name for). Unless someone (i.e., @codinghorror) has some reason not to, I’ll try to do this later this week. I’ll also see about changing the scary “your ip doesn’t resolve to your hostname” message too. It continues to confuse people. Or maybe I’ll look again at finding a more reliable way to test that the resolved host IP connects to the server.

[imagen] pfaffman: I’ll include a link to this post in my next exchange with them. OK then, let me give you the full spiel, then: Port 25 outbound is an obvious candidate for filtering, because if you can hit the Internet on port 25, you can deliver e-mail to practically anyone. If that e-mail is unwanted, the only useful “identity” information that the recipient has to try and prevent further abuse is the sending IP address. That identity is tied, in general, to a hosting provider, not an individual subscriber, so any reputation hit for spamming goes, in the first instance, onto the hosting provider. For a cloud provider, whose only customer contact is a (potentially stolen) credit card, there are practically zero consequences that can be imposed on the actual responsible party (the customer). So, the hosting provider ends up wearing the blame. It’s no surprise, therefore, that cloud providers are somewhat reticent to let everyone have unfettered outbound port 25. It’s a shame, but it’s not a surprise. The thing is, port 587 is a whole different kettle of fish. You cannot deliver e-mail to any address on the Internet by connecting to port 587. In order to get an e-mail sent through port 587, you need to, at the very least, authenticate yourself. That provides an identity, separate from the sending IP address, on which to apply consequences. If the e-mail ends up being spam, then it’s the e-mail provider (as the party which made the connection to port 25) which takes the reputation hit. They know this, and there’s all sorts of stuff they do to balance “getting paid to deliver e-mail” and “not getting blacklisted to hell and back” (with varying levels of success). My point here is that the reputation hit from delivering an e-mail that was submitted over port 587 lands on the intermediary, not the hosting provider. Now, you might say, “aha! but the Received: headers will show it came from our IP space originally, and we’ll still get blamed”. There’s two responses to that. First off, nobody who’s been doing e-mail for more than five minutes believes any Received header they didn’t generate, because they’re trivial to spoof. Much fun was had in the good old days blaming spam on all sorts of innocent parties via that trick. Second of all, if you’re worried about multi-hop reputation problems, you need to block 2525 as well, because guess what? 2525 is a de facto standard submission port, as well, because some people can’t remember two different numbers, or something. They behave practically identically, and any problems you’d have if you allowed submission over the standard port of 587 also apply to submission over 2525. So, yeah. Unblock outbound 587, please. The Internet thanks you.

I’ll submit that next time I get to a computer. I suspect it’s new accounts that are getting filtered, which is a significant proportion of my installs. A while back, mailgun started requiring credit cards; I told people to give credit card numbers. I can’t suggest a fix here (Other than use 2525). Your logic about filtering 587 seems sound. We’ll see.

[imagen] pfaffman: adding a simple “can we connect to the smtp server at all” test still seems like a reasonable idea. Probably fine to quick test the 587 port during setup and warn if it is not working, but that is not what was proposed in first post.

I had some emails forwarding through my server (at DO) and they indeed got blocked. Nothing related to Discourse. But they are indeed cracking down on some servers and they are going by the policy shoot… then ask. So we had to go through all these hoops to get our email back. Just my 2c

Well, I can’t say this is new: [image] This was on 2014-12-25, and I didn’t get my Discourse for Christmas.

Not new, but I’ve not seen it until now, and the install that I just did. . . root@online:~# telnet smtp.mailgun.org 587 Trying 50.17.85.209... ^C root@online:~# ^C root@online:~# telnet smtp.mailgun.org 2525 Trying 52.24.219.230... Connected to smtp.mailgun.org. Escape character is '^]'. 220 ak47 ESMTP ready

[imagen] pfaffman: Not new, but I’ve not seen it until now, and the install that I just did. . . Yeah, they say it depends on your context. If you come from a 3rd world country IP, you get all sorts of problems like that. At OVH I can’t even get a server. It’s like credit, DO will analyze all the info they have on you, and if you check enough boxes, you are a potential spammer / abuser and gets a different config. That’s why me, @brunoedigital and @nixie are affected but not you guys from the north.

[imagen] Falco: It’s like credit, DO will analyze all the info they have on you, and if you check enough boxes, you are a potential spammer / abuser and gets a different config. Could we sue then for this prejudice against us? :wink: Just kidding. But indeed I got blocked here. So that’s probably one of the reasons.

Lovely explication, @mpalmer. Crickets from Digital Ocean. I’ve changed my install script to use 2525 since there’s no easy way to tell whether 587 is blocked (my script blindly pipes values into ./discourse-setup so that I’m continually making sure that it’s working correctly). It appears that people who use Digital Ocean and want to get their ports un-blocked need to file a ticket to request that, which is not something I’m willing to ask my install customers to do if at all possible. [imagen] codinghorror: Probably fine to quick test the 587 port during setup and warn if it is not working, I’ll try to add such a test to ./discourse-setup in the next week.

[imagen] pfaffman: I propose these changes to discourse-setup changing default SMTP port for those services to 2525. adding a test (e.g., nc -z -w5 smtp.mailgun.org 25) to see if the chosen SMTP port is open Why those 3 services services? They’re the ones that discourse-setup currently knows about and recommends smtp_user_name for). With the recent decision by DO to block port 587 for all new droplets, perhaps it is time to revisit this.

Cambios propuestos en discourse-setup porque Digital Ocean bloquea el SMTP saliente

Desarrollador

nathank (Nathan Kershaw) 5 Mayo, 2025 07:24 23

¿Estás dispuesto a enviar una PR para discourse-setup para que sea el nuevo valor predeterminado?

Tema		Respuestas	Vistas
Looks like DO is disabling Smtp in their Discourse hosting plans Self-hosting hosting	25	1103	20 Agosto 2024
DigitalOcean blocking SMTP and forcing SendGrid usage Product Support email	11	4140	17 Abril 2025
Any alternative way to connect to email service then SMTP (on Digital Ocean) Product Support email	6	548	18 Abril 2025
Digital Ocean, SendGrid, Netlfity - Register Admin account email not coming through Self-hosting	30	3608	29 Diciembre 2020
If local logins are disabled Product Support	29	1223	17 Julio 2026

Cambios propuestos en discourse-setup porque Digital Ocean bloquea el SMTP saliente

Temas relacionados