# Proposed changes to discourse-setup because Digital Ocean blocks outbound smtp
**URL:** https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778
**Category:** Development
**Created:** [7월 25, 2017, 1:30오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778 "2017-07-25T13:30:12Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 1:30오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/1 "2017-07-25T13:30:12Z")
Continuing the discussion from [Digital Ocean is blocking outgoing mail!](https://meta.discourse.org/t/digital-ocean-is-blocking-outgoing-mail/66740/26):
It seems that Digital Ocean is blocking out bound SMTP traffic for at least some customers. My guess is that soon you’ll have to jump through hoops to be able to access a remote SMTP port. Simple solution: Mailgun, Sendgrid, and Sparkpost all accept TLS traffic on port 2525.
I propose these changes to `discourse-setup`
- changing default SMTP port for those services to 2525.
- adding a test (e.g., `nc -z -w5 smtp.mailgun.org 25`) to see if the chosen SMTP port is open
Why those 3 services services? They’re the ones that `discourse-setup` currently knows about and recommends `smtp_user_name` for).
Unless someone (i.e., @codinghorror) has some reason not to, I’ll try to do this later this week.
I’ll also see about changing the scary “your ip doesn’t resolve to your hostname” message too. It continues to confuse people. Or maybe I’ll look again at finding a more reliable way to test that the resolved host IP connects to the server.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 25, 2017, 2:05오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/2 "2017-07-25T14:05:52Z")
I don’t agree with any of this. Unless you have actual evidence that DO is globally blocking the smtp port for _all_ new signups, not just some of them…
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [7월 25, 2017, 9:07오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/3 "2017-07-25T21:07:09Z")
You don’t agree with any of it? I’d say having the set-up script test that the named mail server can be reached on the named port is a good thing and will help people identify problems faster. Maybe do nothing else is done to help people get around the blockage, lest DO get more aggressive.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 9:11오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/4 "2017-07-25T21:11:46Z")
The response that I just got from Digital Ocean didn’t say “Yeah, we’re blocking everyone by default”, so perhaps my knee-jerk reaction was out of line, but adding a simple “can we connect to the smtp server at all” test still seems like a reasonable idea.
Here’s their response, which I find unsatisfying. Note that this DO tech says that his only way to know if a droplet has been blocked is to try to telnet to google’s smtp servers.
> [@](#):
>
> Unfortunately, I can’t share the specifics about when a new Droplet has an SMTP block applied to it. There are multiple variables that are taken into account on our end before any block is put in place.
>
> My usual way of checking if mail is blocked is checking connectivity to common mail services:
>
> telnet [smtp.gmail.com](http://smtp.gmail.com) 25
>
> If those fail, I’d usually reach out looking to get SMTP unblocked.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [7월 25, 2017, 10:43오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/5 "2017-07-25T22:43:36Z")
We shouldn’t be sending mail on port 25 anyway. 587 is the “submission” port, for MUAs (which is what Discourse is) to _submit_ mail to a fully-fledged MTA, using an encrypted and authenticated connection. AFAIK all decent ESPs support submission, and if a provider blocks 587 outbound, I’m more than happy to go full rage-womble on them, because there is absolutely zero reason to do so on anti-abuse grounds.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 11:04오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/6 "2017-07-25T23:04:18Z")
I wasn’t clear, then. They are also blocking 587. It seems to be the case that they are blocking all standard ports that transmit mail.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [7월 25, 2017, 11:08오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/7 "2017-07-25T23:08:06Z")
> [@pfaffman](#):
>
> They are also blocking 587.
I’ll spin up a test droplet, and if I can reproduce, then it will be rage-womble: ENGAGED.
Addendum: drat, they’re wise to my plan and my test droplet could do outbound 587. If anyone gets a direct contact at DO who wants to argue the point, feel free to point them my way, otherwise it’s a bit weird to be raising a ticket for a problem I’m not actually having…
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 11:15오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/8 "2017-07-25T23:15:19Z")
I doubt you’ll reproduce. With a new account, maybe. Maybe with a new account? Maybe a new account that doesn’t have a credit card?
Among my frustrations is that they won’t say what makes you get blocked. I guess if that were public it’d tell spammers how to sneak by.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 11:17오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/9 "2017-07-25T23:17:53Z")
I’ll include a link to this post in my next exchange with them.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [7월 25, 2017, 11:49오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/10 "2017-07-25T23:49:11Z")
> [@pfaffman](#):
>
> I’ll include a link to this post in my next exchange with them.
OK then, let me give you the full spiel, then:
Port 25 outbound is an obvious candidate for filtering, because if you can hit the Internet on port 25, you can deliver e-mail to practically anyone. If that e-mail is unwanted, the only useful “identity” information that the recipient has to try and prevent further abuse is the sending IP address. That identity is tied, in general, to a hosting provider, not an individual subscriber, so any reputation hit for spamming goes, in the first instance, onto the hosting provider. For a cloud provider, whose only customer contact is a (potentially stolen) credit card, there are practically zero consequences that can be imposed on the _actual_ responsible party (the customer). So, the hosting provider ends up wearing the blame. It’s no surprise, therefore, that cloud providers are somewhat reticent to let everyone have unfettered outbound port 25. It’s a shame, but it’s not a surprise.
The thing is, port 587 is a whole different kettle of fish. You cannot deliver e-mail to any address on the Internet by connecting to port 587. In order to get an e-mail sent through port 587, you need to, at the very least, _authenticate_ yourself. That provides an identity, separate from the sending IP address, on which to apply consequences. If the e-mail ends up being spam, then it’s the e-mail provider (as the party which made the connection to port 25) which takes the reputation hit. They know this, and there’s all sorts of stuff they do to balance “getting paid to deliver e-mail” and “not getting blacklisted to hell and back” (with varying levels of success). My point here is that the reputation hit from delivering an e-mail that was submitted over port 587 lands on the intermediary, not the hosting provider.
Now, you might say, “aha! but the Received: headers will show it came from our IP space _originally_, and we’ll still get blamed”. There’s two responses to that. First off, nobody who’s been doing e-mail for more than five minutes believes any Received header they didn’t generate, because they’re trivial to spoof. Much fun was had in the good old days blaming spam on all sorts of innocent parties via that trick. Second of all, if you’re worried about multi-hop reputation problems, you need to block 2525 as well, because guess what? 2525 is a de facto standard submission port, as well, because some people can’t remember two different numbers, or something. They behave practically identically, and any problems you’d have if you allowed submission over the standard port of 587 also apply to submission over 2525.
So, yeah. Unblock outbound 587, please. The Internet thanks you.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 25, 2017, 11:58오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/11 "2017-07-25T23:58:47Z")
I’ll submit that next time I get to a computer.
I suspect it’s new accounts that are getting filtered, which is a significant proportion of my installs. A while back, mailgun started requiring credit cards; I told people to give credit card numbers. I can’t suggest a fix here (Other than use 2525).
Your logic about filtering 587 seems sound. We’ll see.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 26, 2017, 12:11오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/12 "2017-07-26T00:11:07Z")
> [@pfaffman](#):
>
> adding a simple “can we connect to the smtp server at all” test still seems like a reasonable idea.
Probably fine to quick test the 587 port during setup and warn if it is not working, but that is not what was proposed in first post.
---
### Author:  [@brunoedigital](https://meta.discourse.org/u/brunoedigital)
#### Post date: [7월 26, 2017, 12:17오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/13 "2017-07-26T00:17:31Z")
I had some emails forwarding through my server (at DO) and they indeed got blocked. Nothing related to Discourse. But they are indeed cracking down on some servers and they are going by the policy _shoot… then ask_.
So we had to go through all these hoops to get our email back.
Just my 2c
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [7월 26, 2017, 12:20오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/14 "2017-07-26T00:20:12Z")
Well, I can’t say this is new:
This was on 2014-12-25, and I didn’t get my Discourse for Christmas.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 26, 2017, 12:30오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/15 "2017-07-26T00:30:47Z")
Not new, but I’ve not seen it until now, and the install that I just did. . .
```plaintext
root@online:~# telnet smtp.mailgun.org 587
Trying 50.17.85.209...
^C
root@online:~# ^C
root@online:~# telnet smtp.mailgun.org 2525
Trying 52.24.219.230...
Connected to smtp.mailgun.org.
Escape character is '^]'.
220 ak47 ESMTP ready
```
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [7월 26, 2017, 12:37오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/16 "2017-07-26T00:37:35Z")
> [@pfaffman](#):
>
> Not new, but I’ve not seen it until now, and the install that I just did. . .
Yeah, they say it depends on your **context**. If you come from a 3rd world country IP, you get all sorts of problems like that. At OVH I can’t even get a server.
It’s like credit, DO will analyze all the info they have on you, and if you check enough boxes, you are a potential spammer / abuser and gets a different config.
That’s why me, @brunoedigital and @nixie are affected but not you guys _from the north._
---
### Author:  [@brunoedigital](https://meta.discourse.org/u/brunoedigital)
#### Post date: [7월 26, 2017, 12:53오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/17 "2017-07-26T00:53:02Z")
> [@Falco](#):
>
> It’s like credit, DO will analyze all the info they have on you, and if you check enough boxes, you are a potential spammer / abuser and gets a different config.
Could we sue then for this prejudice against us? 😉
Just kidding.
But indeed I got blocked here. So that’s probably one of the reasons.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7월 26, 2017, 4:13오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/18 "2017-07-26T16:13:04Z")
Lovely explication, @mpalmer. Crickets from Digital Ocean.
I’ve changed my install script to use 2525 since there’s no easy way to tell whether 587 is blocked (my script blindly pipes values into `./discourse-setup` so that I’m continually making sure that it’s working correctly).
It appears that people who use Digital Ocean and want to get their ports un-blocked need to file a ticket to request that, which is not something I’m willing to ask my install customers to do if at all possible.
> [@codinghorror](#):
>
> Probably fine to quick test the 587 port during setup and warn if it is not working,
I’ll try to add such a test to `./discourse-setup` in the next week.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [3월 31, 2025, 12:59오전 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/19 "2025-03-31T00:59:22Z")
> [@pfaffman](#):
>
> `discourse-setup`에 대한 다음 변경 사항을 제안합니다.
>
> - 해당 서비스들의 기본 SMTP 포트를 2525로 변경합니다.
> - 선택된 SMTP 포트가 열려 있는지 확인하기 위한 테스트(예: `nc -z -w5 smtp.mailgun.org 25`)를 추가합니다.
>
> 왜 그 3가지 서비스인가요? `discourse-setup`가 현재 인식하고 있으며 `smtp_user_name` 사용을 권장하는 서비스들이기 때문입니다.
최근 DO(디지털오션)가 모든 새 드롭렛에 대해 포트 587을 차단하기로 결정했으므로, 이 문제를 다시 검토할 때가 된 것 같습니다.
---
### Author:  [@cipheos](https://meta.discourse.org/u/cipheos)
#### Post date: [5월 1, 2025, 10:02오후 UTC](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778/20 "2025-05-01T22:02:42Z")
아니요, 그들은 훨씬 더 공격적이 되었습니다. 며칠 전까지는 587 포트를 통해 메일을 정상적으로 보낼 수 있었던 서비스가 그 위에 호스팅되어 있었거든요. 일부 서비스는 사용자 인증에 이메일을 필요로 하므로, 이런 변화는 상당한 rug pull(갑작스러운 서비스 변경)이라고 할 수 있습니다. 게다가 VPN으로 연결된 상태에서 메일을 보낼 수 없게 되었습니다. 게이트웨이를 그쪽에 호스팅하고 있기 때문이죠. 이 모든 것이 지난주까지는 우리에게는 정상적으로 작동하고 있었습니다. 지금이야말로 걱정해야 할 때라고 분명히 말할 수 있습니다.
[다음 페이지](https://meta.discourse.org/t/proposed-changes-to-discourse-setup-because-digital-ocean-blocks-outbound-smtp/66778.md?page=2)