1 Topic by MW (edited by MW 2020-09-23 17:42:45)

  • MW
  • Member
  • Offline
  • Registered: 2019-03-18
  • Posts: 30

Topic: Getting SMTP AUTH is required for users under this sender domain error

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): latest 1.3
- Deployed with iRedMail Easy or the downloadable installer? downloadable
- Linux/BSD distribution name and version: Ubuntu 18
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I have some complicated setup, goes like this:

My iRedMail mail server is something like: mail.mine.com

domain-one.com mail accounts are hosted on G Suite (MX records point to Google's servers). Using the G Suite admin interface I can configure that email sent to extra@domain-one.com (which should not be managed by G Suite) should be routed to: mail.mine.com

On iRedMailAdmin I added domain-one.com and added under it the user: extra@domain-one.com.

In fact, if someone sends email to: extra@domain-one.com it gets delivered to my iRedMail based server. I have managed also to send emails from extra@domain-one.com to anywhere (using Sogo etc.).

Problem arises when some-user@domain-one.com using G Suite GMail (a user managed by G Suite) interface sends email to an address hosted on my iRedMail server. The error I can see on maillog:

NOQUEUE: reject: RCPT from mail-qt1-f173.google.com[209.85.160.173]: 554 5.7.1 <someone@domain-hosted-on-my-iredmail-server.com>: Recipient address rejected: SMTP AUTH is required for users under this sender domain; from=<some-user@domain-one.com> to=<someone@domain-hosted-on-my-iredmail-server.com> proto=ESMTP helo=<mail-qt1-f173.google.com>

iRedMail rejects the e-mail sent by Google's servers (FROM: some-user@domain-one.com) because domain-one.com is registered also on the iRedMail Server and iRedMail is not told to expect that e-mails for this domain-one.com could be sent by G Suite.

Any idea how to solve this?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by MW

  • MW
  • Member
  • Offline
  • Registered: 2019-03-18
  • Posts: 30

Re: Getting SMTP AUTH is required for users under this sender domain error

[SOLUTION]

The solution is to add Google's mail servers IP ranges to mynetworks in POSTFIX main.cf.

Not sure is there is a simpler solution since their IP ranges may change over time and not sure about the security related aspects of this setting.

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,788

Re: Getting SMTP AUTH is required for users under this sender domain error

MW wrote:

The solution is to add Google's mail servers IP ranges to mynetworks in POSTFIX main.cf.

This is not a good idea.
Instead, you can add this parameter to /opt/iredapd/settings.py (and restart "iredapd" service):

ALLOWED_FORGED_SENDERS = ["domain-one.com"]

Check detailed comment lines in /opt/iredapd/libs/default_setings.py for more info.

4 Reply by MW (edited by MW 2020-09-26 03:34:38)

  • MW
  • Member
  • Offline
  • Registered: 2019-03-18
  • Posts: 30

Re: Getting SMTP AUTH is required for users under this sender domain error

ZhangHuangbin wrote:

This is not a good idea.
Instead, you can add this parameter to /opt/iredapd/settings.py (and restart "iredapd" service):

Thanks ZhangHuangbin for sharing this information.

What I have done finally to resolve this without modification to main.cf or iRedPad's settings.py (without the ALLOWED_FORGED_SENDERS setting) is to add google's IP's and my server's IP to the SPF record of the domain. This resolved the issue (despite that it took some time due to DNS propagation).

I believe that this is also a valid and secure way to do it ? Correct me please.

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,788

Re: Getting SMTP AUTH is required for users under this sender domain error

Your solution is better than updating "ALLOWED_FORGED_SENDERS".
iRedAPD checks SPF record, if sender server IP is not listed in SPF and sender is considered as forged, it will be rejected. But if it's listed in SPF, it's considered as trusted.

6 Reply by MW

  • MW
  • Member
  • Offline
  • Registered: 2019-03-18
  • Posts: 30

Re: Getting SMTP AUTH is required for users under this sender domain error

ZhangHuangbin wrote:

iRedAPD checks SPF record, if sender server IP is not listed in SPF and sender is considered as forged, it will be rejected. But if it's listed in SPF, it's considered as trusted.

Thank you.