Problem registering an email account on a cell phone

[turbo6928]

SYSTEM INFORMATION
OS type and version	Ubuntu Linux 24.04.3
Virtualmin version	7.40.1 Pro

I’m having trouble registering an email account on my cell phones. It lets me register the incoming server, but the outgoing server gives a connection error. My VirtualMin works perfectly and sends and receives emails from UserMin.
Who has had something similar happen to them? How did they resolve it?

[Joe]

@turbo6928

but the outgoing server gives a connection error.

What port are you trying to use and are you sure your phone network provider allows access to that port? Most block port 25, so you’d generally use the submission port 587. 465 may also be used for outgoing mail in a Virtualmin system with slightly different configuration.

[dimitrist]

Are your outgoing email settings, exactly as mentioned in Virtualmin → virtual_server → Edit Users → Show Email Client Settings : SMTP … (outgoing settings) ?
could be mail.hostname or just hostname, with port 587 (submission) + STARTTLS. are you using those or something different?
is your ssl certificate correct for mail server?
have you tried setting the same account on another email client (eg. outlook/thunderbird)?

[turbo6928]

Yes of course, I already used it before… I had to format the server and now it won’t let me, it has the initial configuration and I’m trying 587 starttls and 465 ssl/tls, smtp server (mail.mydomain), password, full username… and nothing… it says it can’t connect to the server.

[turbo6928]

Yes, it is the same Virtualmin configuration, I attach the photos… I use Let’s Encrypt certificates… and I have tried to configure it in Thunderbird and nothing, it only lets me receive emails, the outgoing server does not work… it only works correctly in Usermin

[dimitrist]

MX dns record (mail.domain) seems to be a CNAME. this is not allowed for MX.
use an A dns record for mail.domain pointing to your server ip. then retry.

or

try using main domain (without mail. ) as SMTP server and retry, see if that helps.

[Joe]

Seems like nothing could work (regardless of it being a phone). You’re either blocking the necessary ports in your firewall, or your host is.

# nmap -p 587 mail.criolla.com.ve
Starting Nmap 7.92 ( https://nmap.org ) at 2025-09-30 19:00 UTC
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.12 seconds
# nmap -p 465 mail.criolla.com.ve
Starting Nmap 7.92 ( https://nmap.org ) at 2025-09-30 19:01 UTC
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.12 seconds

[Joe]

For comparison:

[root@wp ~]# nmap -p587 mail.virtualmin.com
Starting Nmap 7.92 ( https://nmap.org ) at 2025-09-30 19:03 UTC
Nmap scan report for mail.virtualmin.com (45.76.233.251)
Host is up (0.00055s latency).
rDNS record for 45.76.233.251: n1.virtualmin.com

PORT    STATE SERVICE
587/tcp open  submission

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
[root@wp ~]# nmap -p465 mail.virtualmin.com
Starting Nmap 7.92 ( https://nmap.org ) at 2025-09-30 19:03 UTC
Nmap scan report for mail.virtualmin.com (45.76.233.251)
Host is up (0.00042s latency).
rDNS record for 45.76.233.251: n1.virtualmin.com

PORT    STATE SERVICE
465/tcp open  smtps

Nmap done: 1 IP address (1 host up) scanned in 0.15 seconds

[dimitrist]

@Joe

nmap -p 587 mail.criolla.com.ve

@Joe port seems open just fine :

$ nmap -p 587 mail.criolla.com.ve
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-30 22:05 EEST
Nmap scan report for mail.criolla.com.ve (45.195.12.211)
Host is up (0.25s latency).

PORT    STATE SERVICE
587/tcp open  submission

[turbo6928]

I didn’t understand you… How should I set the MX? I’m attaching my DNSexit configuration.

[turbo6928]

Yes, it is open and it tells me that it is filtered.

PS C:\Users\Administrador> nmap -p 587 mail.criolla.com.ve
Starting Nmap 7.98 ( https://nmap.org ) at 2025-09-30 15:33 -0400
Nmap scan report for mail.criolla.com.ve (45.195.12.211)
Host is up (0.0030s latency).

PORT STATE SERVICE
587/tcp filtered submission

Nmap done: 1 IP address (1 host up) scanned in 1.35 seconds
PS C:\Users\Administrador>

and it connects but fails to negotiate the certificate..

PS C:\Program Files\OpenSSL-Win64\bin> .\openssl.exe s_client -starttls smtp -connect mail.seguridad.org.ve:587 -crlf
Connecting to 45.195.12.211
CONNECTED(000001BC)
Didn’t find STARTTLS in server response, trying anyway…
write:errno=10053

no peer certificate available

No client certificate CA names sent
Negotiated TLS1.3 group:

SSL handshake has read 90 bytes and written 23 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

PS C:\Program Files\OpenSSL-Win64\bin>

[dimitrist]

(whatever this dnsexit service is), add mail.domain, not as an alias/CNAME (delete that CNAME record), and add an A record for mail.domain with the ip address of the server.
leave MX record as is.

btw, ssl for domain and port 587 seems fine/open over here.

[turbo6928]

and the server is listening correctly

[stefan1959]

May try criolla.com.ve as the server address rather then mail.criolla.com.ve (in the settings on the phone), see if it gets the same result. I have port 465 on my phone for smtp.

[turbo6928]

I tested it with criolla.com.ve and it gave me this error: 454# 4.7.0 temporary authentication failure generic failure

[turbo6928]

I’ve solved it. Thank you all very much.
It was a setting in etc/postfix/mater.cf
This is what worked for me:

smtp inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_security_level=may
smtps inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_wrappermode=yes
-o smtpd_tls_security_level=may
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
submission inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_security_level=may
-o smtpd_client_restrictions=permit_sasl_authenticated,reject

thanks