### Author:  [@maltfield](https://meta.discourse.org/u/maltfield)
#### Post date: [November 7, 2019, 1:32pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/1 "2019-11-07T13:32:21Z")
What are the correct settings passed to `./discourse-setup` for connecting to an smtp server on localhost:25 without auth?
I’m very surprised that this isn’t supported OOTB; it’s the default config on most linux installs..
My server runs postfix locally; it is not accessible from the Internet. It works fine, for example, when running the `mail` command. I found a few unofficial guides on the Internet suggesting changes to `/var/discourse/containers/app.yml`, and I finally got it to install & start with the following settings:
```plaintext
DISCOURSE_SMTP_ADDRESS: localhost
DISCOURSE_SMTP_PORT: 25
DISCOURSE_SMTP_USER_NAME: discourse@opensouceecology.org
DISCOURSE_SMTP_PASSWORD: "none"
DISCOURSE_SMTP_AUTHENTICATION: none
DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
DISCOURSE_SMTP_ENABLE_START_TLS: false
```
Note that if I omit the DISCOURSE\_SMTP\_USER\_NAME or DISCOURSE\_SMTP\_PASSWORD variables, your install script yells at me stating that they’re required (bug?).
And now when I click the “Resend Activation Email” button in the Discourse wui, this entry pops-up in the log file (/var/discourse/shared/standalone/log/rails/production.log):
```plaintext
Started PUT "/finish-installation/resend-email" for 127.0.0.1 at 2019-11-07 13:15:31 +0000
Processing by FinishInstallationController#resend_email as HTML
Parameters: {"authenticity_token"=>"SzQCvRWiqdXsBKzOjIB0X7KkvXro7Od6SdP8Qa8vvrskPeNYZNos5ORHJfyDUrHiKShZR/txM6NHuqHHCQCR1w=="}
Rendering finish_installation/resend_email.html.erb within layouts/finish_installation
Rendered finish_installation/resend_email.html.erb within layouts/finish_installation (Duration: 0.7ms | Allocations: 103)
Rendered layouts/_head.html.erb (Duration: 0.5ms | Allocations: 103)
Completed 200 OK in 98ms (Views: 3.0ms | ActiveRecord: 0.0ms | Allocations: 4763)
Rendering layouts/email_template.html.erb
Rendered layouts/email_template.html.erb (Duration: 0.5ms | Allocations: 141)
Delivered mail c4ca58ca-345e-46c4-81bc-6d0eac7afa04@discourse.opensourceecology.org (11.3ms)
Job exception: wrong authentication type none
```
…But my authentication type _is_ ‘none’. What should the correct setting be for no authentication?
EDIT: also, can someone link me to the doc that defines all of the possible “DISCOURSE\_SMTP\_\*” variables and all of their valid values?
EDIT2: this is proving to be far more difficult than it should be. I think ‘localhost’ is resolving inside the docker container to the Discourse docker container itself (`app`) – not the docker host that is running my postfix smtp server. That’s further complicated by postfix’s `mynetworks` and `iptables` (which were configured by the `discourse-setup` script or its children scripts). What’s the correct config here to just have Discourse use the smtp server on which I want to run Discourse, with no smtp auth?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 7, 2019, 3:14pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/2 "2019-11-07T15:14:00Z")
> [@maltfield](#):
>
> I’m very surprised that this isn’t supported OOTB; it’s the default config on most linux installs…
I think that hasn’t been very true for about 20 years.
You can’t use discourse-setup for situations like yours because few people have non password protected smtp servers, even behind a firewall.
What I would do is configure smtp passwords for my mail server. There really isn’t much downside.
If you don’t want to do that I think that instead of “none” for authentication you might want “” (and similarly for the password and username).
> [@maltfield](#):
>
> I think ‘localhost’ is resolving inside the docker container to the Discourse docker container itself ( `app` ) – not the docker host that is running my postfix smtp server.
I think so too. You might try using the container name. I think that you need to see that they are both on the same docker network.
---
### Author:  [@maltfield](https://meta.discourse.org/u/maltfield)
#### Post date: [November 25, 2019, 10:27am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/3 "2019-11-25T10:27:11Z")
> [@pfaffman](#):
>
> I think that hasn’t been very true for about 20 years.
In 2019, it’s the default config for postfix on RHEL/CentOS. Postfix binds only to the loopback interface and drops all smtp requests that don’t originate from `127.0.0.0/8`. No auth required. I’m not sure about debian, but I’d _imagine_ `exim` has a similar default config.
A couple relevant topics on these forums from other users who hit this issue:
- [How to set SMTP config to use localhost?](https://meta.discourse.org/t/how-to-set-smtp-config-to-use-localhost/131464)
- [https://meta.discourse.org/t/smtp-without-user-or-password/88879](https://meta.discourse.org/t/smtp-without-user-or-password/88879)
There doesn’t appear to be a topic for how to set this up on RHEL/Cent OS with the necessary changes to both Discourse _and_ postfix, so I’m documenting this here.
This does not appear to be possible with the `discourse-setup` script, but I did get this to work.
First, I had to figure out the IP address of the docker host as the docker container sees it. Using `127.0.0.1` won’t work because the docker container will see `127.0.0.1` as _itself_. Rather, we need to specify the IP address or hostname of the docker _host_ that is running the postfix SMTP server, and one that is addressible by the docker container (so not your docker host’s Internet-facing IP address if you want your SMTP server to not be Internet-accessible, for example).
I extracted the relevant IP address of the docker host (`172.17.0.1`) from the `docker0` interface by executing this on the docker host:
```plaintext
[maltfield@osestaging1 ~]$ ip address show docker0
3: docker0: mtu 1500 qdisc noqueue state UP
link/ether 02:42:80:35:65:a1 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:80ff:fe35:65a1/64 scope link
valid_lft forever preferred_lft forever
[maltfield@osestaging1 ~]$
```
Then I edited my Discourse app’s yaml file, setting the “DISCOURSE\_SMTP\_ADDRESS” to `172.17.0.1` from above.
```plaintext
[maltfield@osestaging1 ~]$ cd /var/discourse/
[maltfield@osestaging1 discourse]$ grep SMTP containers/app.yml
DISCOURSE_SMTP_ADDRESS: 172.17.0.1
DISCOURSE_SMTP_PORT: 25
DISCOURSE_SMTP_AUTHENTICATION: none
DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
DISCOURSE_SMTP_ENABLE_START_TLS: false
[maltfield@osestaging1 discourse]$
```
Note that I first tried to use the internal docker hostname `host.docker.internal` for this, but apparently this hostname isn’t available to linux docker users
- [Support host.docker.internal DNS name to host · Issue #264 · docker/for-linux · GitHub](https://github.com/docker/for-linux/issues/264)
Because the default postfix configuration in RHEL/Cent OS binds only to 127.0.0.1 (which is good), you’ll need to change `/etc/postfix/main.cf` so it also binds to the `docker0` interface and add that subnet to the `mynetworks` group so that SMTP traffic coming from docker containers will be accepted by postfix.
```plaintext
[maltfield@osestaging1 postfix]$ grep -ir '172.17' /etc/postfix/*
/etc/postfix/main.cf:inet_interfaces = 127.0.0.1, 172.17.0.1
/etc/postfix/main.cf:mynetworks = 127.0.0.0/8, 172.17.0.0/16
[maltfield@osestaging1 postfix]$
```
After those changes, rebuild Discourse and it should now be able to send emails out through your docker host’s postfix.
```plaintext
/var/discourse/launcher rebuild app
```
While this works, I have a few questions:
1. Is there some other environment variable or hostname that already points to the docker host (`172.17.0.1` in this case)?
I noticed that there is a [DISCOURSE\_HOST\_IP](https://github.com/discourse/discourse_docker/blob/d775b4623752b7c53e1e98784ae39109a25a5b25/launcher#L103) environment variable “injected” by `launcher`. Is it possible to set this `DISCOURSE_SMTP_ADDRESS` yaml key to the same value as the other’s yaml key with something like this?
```plaintext
DISCOURSE_SMTP_ADDRESS: $DISCOURSE_HOST_IP
```
1. In general, how durable is the `172.17.0.1` IP of the docker host? Is it always this IP on RHEL/Cent OS systems? Will it ever change on me?
---
### Author:  [@Kostya\_Vasilyev](https://meta.discourse.org/u/Kostya_Vasilyev)
#### Post date: [September 22, 2020, 6:25am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/4 "2020-09-22T06:25:42Z")
@maltfield Just wanted to say thank you for the instructions.
I ran into same issue on Debian… Could create a separate mail user for Discourse I suppose and have it connect and log in to site:465 but connecting to port 25 from the inside is more logical, in my opinion.
And by the way, on Debian 10 with [docker.io](http://docker.io) from the repositories - docker0 is still 172.17.0.1/16.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [September 22, 2020, 7:18am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/5 "2020-09-22T07:18:37Z")
> [@pfaffman](#):
>
> I think that hasn’t been very true for about 20 years.
>
> You can’t use discourse-setup for situations like yours because few people have non password protected smtp servers, even behind a firewall.
Maybe you are misunderstanding what @maltfield is saying?
For as long as I can remember (which goes further back than 20 years), Linux ( / Unix / BSD / Solaris) systems have an SMTP server running which is configured by default to be happy to relay anything received from localhost without any questions. This relieves any other application running on that machine from having to worry about and configure SMTP settings themselves.
---
### Author:  [@maltfield](https://meta.discourse.org/u/maltfield)
#### Post date: [September 22, 2020, 7:37am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/6 "2020-09-22T07:37:46Z")
Yes, most linux servers don’t require auth to send mail (either by default or after installl & configuring). Nor is it necessary if they don’t relay from anywhere but the local network. The default Discourse install scripts won’t work for most servers. It’s designed for a narrow set of docker-based cloud solutions.
You can read my full comprehensive instructions for installing Discourse on a dedicated, baremetal server running RHEL/CentOS 7 on the Open Source Ecology wiki. Note the section on SMTP here:
- [Discourse/Install - Open Source Ecology](https://wiki.opensourceecology.org/wiki/Discourse/Install#SMTP)
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 22, 2020, 8:26pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/7 "2020-09-22T20:26:49Z")
Well, I almost always defer to you on such matters! I guess it’s been a good number of years since I’ve run an SMTP server on localhost, so it’s a good bet that I don’t know what I’m talking about.
> [@maltfield](#):
>
> Yes, most linux servers don’t require auth to send mail (either by default or after installl & configuring).
More evidence that I’m wrong! 🤷♂️
> [@maltfield](#):
>
> You can read my full comprehensive instructions for installing Discourse on a dedicated, baremetal server running RHEL/CentOS 7 on the Open Source Ecology wiki. Note the section on SMTP here:
Nice!
But `discourse-setup` is only ever going to be for people who know virtually nothing about system administration. If you know how to install an SMTP server, you can edit a yml file.
---
### Author:  [@uckelman](https://meta.discourse.org/u/uckelman)
#### Post date: [September 12, 2021, 7:44pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/8 "2021-09-12T19:44:13Z")
If the host where the container is running has a name you can get via DNS, it works just to specify that:
```plaintext
DISCOURSE_SMTP_ADDRESS: real.machine.example.com
```
Postfix will still see that the source of the mail is local and handle it that way.
---
### Author:  [@Jeremiah\_van\_Oosten](https://meta.discourse.org/u/Jeremiah_van_Oosten)
#### Post date: [February 10, 2022, 8:33am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/9 "2022-02-10T08:33:59Z")
If the `DISCOURSE_HOSTNAME` and the `DISCOURSE_SMTP_ADDRESS` are the same, will this cause issues?
I’ve setup Postfix & Dovecot on the Docker host to accept authenticated requests over TLS. I have valid certificates for my server, but whatever configuration I try, I can’t get Discourse to send mails correctly to Postfix running on the Docker host.
If I use the hostname (`discourse.[myhost].com`) it doesn’t work (it won’t even connect). If I use the Docker host IP address (172.17.0.1), I get
```plaintext
hostname "172.17.0.1" does not match the server certificate
```
Clearly, I need to use the FQDN that was used to create the certificates. If I try to set `DISCOURSE_SMTP_ENABLE_START_TLS` to `false` then it says I need to issue a start TLS command. I don’t really want to open Postfix up without TLS, so I don’t really see this as a viable option anyways.
Using an external SMTP relay is also not an option because I don’t want to pay more just to ensure emails don’t end up in people’s spam/junk folders.
I’ve got to say, I’ve only have a rudimentary understanding of Docker networking, an even less understanding of setting up a Postfix SMTP server with Dovecot for authentication, but I’m not a complete noob, but getting this setup in a safe/secure way is proving to be extremely difficult.
@maltfield I’ve read you’re article on Open Source Ecology but I don’t want to use unauthenticated over port 25. The university I work for has very strict protocols about using unencrypted, unauthenticated communication (even within a local network setup like this). They are too worried that it could be abused by a disgruntled student.
---
### Author:  [@Jeremiah\_van\_Oosten](https://meta.discourse.org/u/Jeremiah_van_Oosten)
#### Post date: [February 10, 2022, 10:17am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/10 "2022-02-10T10:17:35Z")
So, I figured there was something fishy about using using the same hostname for both the Discourse server and the SMTP server.
Further investigation reveals that the docker container adds the following entry to the `hosts` file:
```plaintext
172.17.0.2 discourse.[mydomain].com discourse
```
So any attempt to use the same hostname for the running container and the docker host will cause all requests issued from the container to go to the container itself and not the docker host.
What a fiasco! Why doesn’t Discourse just provide a default configure SMTP server in the container!?
OR make it easier to use Discourse without Docker!
Two days of my life lost because of this issue.
---
### Author:  [@Jeremiah\_van\_Oosten](https://meta.discourse.org/u/Jeremiah_van_Oosten)
#### Post date: [February 11, 2022, 6:57pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/11 "2022-02-11T18:57:50Z")
In the end, I accept the fact that I **cannot** use TLS to communicate with SMTP running on the docker host (without getting certificates using a different hostname). To get this to finally work, I had to make sure that `172.17.0.0/16` is added to the `mynetworks` variable in Postfix `main.cf` file:
```plaintext
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 172.17.0.0/16
```
This allows Postfix to see any Docker container running on this server to be considered part of the network.
Another change I had to make was to ensure that `smtpd_sasl_security_options` is set to `noanonymous` to prevent “strangers” from using Postfix as a SMTP relay. Make sure the `noplaintext` option is **not** set here otherwise Postfix will only allow authentication using TLS.
```plaintext
smtpd_sasl_security_options = noanonymous
```
With these configuration settings, I could specify the following settings in app.yml:
```plaintext
DISCOURSE_SMTP_ADDRESS: 172.17.0.1 # IP address of the Docker host (as seen from within this container)
DISCOURSE_SMTP_PORT: 25
DISCOURSE_SMTP_USER_NAME: discourse
DISCOURSE_SMTP_PASSWORD: pa$$word
DISCOURSE_SMTP_ENABLE_START_TLS: false # (optional, default true)
DISCOURSE_SMTP_DOMAIN: discourse.[mydomian].com # (required by some providers)
DISCOURSE_NOTIFICATION_EMAIL: noreply@discourse.[mydomain].com # (address to send notifications from)
```
I also created a local user account on the Docker host just for the purpose of SASL authentication.
With these changes, I could finally get mails sent from the container but I can’t help but feel this is a suboptimal configuration. Ideally, it should be possible to use the desired hostname for the Docker host and have requests to `discourse.[mydomain].com` go to the right place.
Now I need to setup SPF and DKIM to get mails landing in people’s inboxes (instead of their spam folders). I _really_ hope that someday this painful process is more automated. Maybe provide some instructions on how to configure discourse without using Docker (so it can be used with cPanel for example..) or make the mail setup less painful by providing some kind of default SMTP configuration directly in the Docker container!
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 12, 2022, 10:45am UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/12 "2022-02-12T10:45:22Z")
> [@Jeremiah\_van\_Oosten](#):
>
> Now I need to setup SPF and DKIM to get mails landing in people’s inboxes (instead of their spam folders). I _really_ hope that someday this painful process is more automated
If you go back to the early 1990s it was as you wish. The things you’re taking about all just worked. But spammers have caused it to be much more complicated. The process will only become more difficult, which is why the recommendation is to use some service that deals with many of the complications for you.
---
### Author:  [@rrit](https://meta.discourse.org/u/rrit)
#### Post date: [February 12, 2022, 9:53pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/13 "2022-02-12T21:53:39Z")
I’m glad you got your mail setup running!
There are some updates on the email troubleshooting guide since yesterday. If you’re still not happy with your mail setup, maybe give it a try again!
> [@Troubleshoot email on a new Discourse install](https://meta.discourse.org/t/troubleshooting-email-on-a-new-discourse-install/16326):
>
> You just installed Discourse via [the install guide](https://github.com/discourse/discourse/blob/main/docs/INSTALL.md), but email doesn’t seem to work. Unfortunately this means you can’t log in as an admin to finalize the install. cry Let’s troubleshootize! Try the doctor woman_health_workerIf you run ./discourse-doctor it will check several ways that your mail configuration might be broken, and offer advice. Try that first. Did you enter email settings correctly? The simplest way is to run ./discourse-setup again. Did you enter everything correctly? B…
* * *
> [@Jeremiah\_van\_Oosten](#):
>
> If I use the Docker host IP address (172.17.0.1), I get
>
> `hostname "172.17.0.1" does not match the server certificate`
> [@Jeremiah\_van\_Oosten](#):
>
> In the end, I accept the fact that I **cannot** use TLS to communicate with SMTP running on the docker host (without getting certificates using a different hostname)
Can be solved by using:
> [@Troubleshoot email on a new Discourse install](https://meta.discourse.org/t/troubleshoot-email-on-a-new-discourse-install/16326/1):
>
> `DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none`
* * *
> [@Jeremiah\_van\_Oosten](#):
>
> So any attempt to use the same hostname for the running container and the docker host will cause all requests issued from the container to go to the container itself and not the docker host.
>
> What a fiasco!
… just default DNS resolving of domain name to IP.
> [@Troubleshoot email on a new Discourse install](https://meta.discourse.org/t/troubleshoot-email-on-a-new-discourse-install/16326/1):
>
> ### 2. Check dns resolving for your smtp server name via `getent hosts` :
>
> ( `dig` , `nslookup` , `ping` etc. are not installed inside the container.)
>
> `getent hosts your.smtp.server`
---
### Author:  [@Jeremiah\_van\_Oosten](https://meta.discourse.org/u/Jeremiah_van_Oosten)
#### Post date: [February 14, 2022, 12:54pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/14 "2022-02-14T12:54:30Z")
Don’t get me wrong. I understand the importance of SPF and DKIM. It’s just annoying. I just wish this could be installed in our current cPanel servers where these kinds of things are already configured.
---
### Author:  [@Jeremiah\_van\_Oosten](https://meta.discourse.org/u/Jeremiah_van_Oosten)
#### Post date: [February 14, 2022, 2:58pm UTC](https://meta.discourse.org/t/connecting-to-a-smtp-server-on-localhost-25-without-auth/156849/15 "2022-02-14T14:58:52Z")
> [@Troubleshoot email on a new Discourse install](https://meta.discourse.org/t/troubleshoot-email-on-a-new-discourse-install/16326/1):
>
> > [@Troubleshoot email on a new Discourse install](https://meta.discourse.org/t/troubleshoot-email-on-a-new-discourse-install/16326/1):
> >
> > `DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none`
This is what I was missing. It is working now with TLS.
I also got DKIM working so mails should not be spammed anymore.