cPanel Emails Not Sending - defer(111): Connection refused (Exim) and SMTP Tweak

[vinayakk]

The actual cause of my problem was caused by playing with cPanel settings SMTP Restrictions (formerly SMTP Tweak). It’s very poorly explained. I extracted this from the cPanel docs explaining SMTP Restrictions:

You may want to prevent users from bypassing your mail server to send mail. This is common practice for spammers.

This feature allows you to configure your server so that the mail transport agent (MTA), Mailman mailing list software, and root user are the only accounts able to connect to remote SMTP servers.

Source: http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/TweakMail


If your clients are not setup to handle sending mail as an authenticated user, suddenly enabling SMTP Restrictions in WHM will cause…

    mailin-01.mx.aol.com [205.188.146.193] Connection refused
    cluster9.us.messagelabs.com [216.82.242.19] Connection refused
    cluster9a.us.messagelabs.com [95.131.108.66] Connection refused
    xxx@xxx.com.au <xxx@xxx.com.au> R=lookuphost T=remote_smtp defer (111): Connection refused
    mailipao.vtcif.telstra.com.au [202.12.144.27] Connection refused
    xxx@telstra.com <xxx@telstra.com> R=lookuphost T=remote_smtp defer (111): Connection refused
    gmail-smtp-in.l.google.com [209.85.221.11] Connection refused
    alt1.gmail-smtp-in.l.google.com [216.239.59.27] Connection refused
    alt2.gmail-smtp-in.l.google.com [74.125.79.114] Connection refused
    alt3.gmail-smtp-in.l.google.com [72.14.221.27] Connection refused
    alt4.gmail-smtp-in.l.google.com [209.85.216.62] Connection refused


cPanel’s SMTP Restrictions does this by adding these rules to iptables:

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     tcp  –  anywhere             localhost           tcp dpt:smtp
    REJECT     tcp  –  anywhere             anywhere            tcp dpt:smtp reject-with icmp-port-unreachable

It effectively firewalls your outbound connection from the server unless you’re an authenticated user, making it appear as if the destination server is blocking you. Unless you look carefully it has the potential to be confusing.