I'm so close, but can't send emails...

Hi there, I went through the various tutorials and installation instructions and have my KumoMTA system working on Rocky Linux 8.9 and I can send emails to it for dispatch. I’ve been watching the queue filling up with emails, but they are just sitting there. The queues are not emptying and dispatching the emails through SMTP.

I am not sure what to provide in regards to my setup, but if anyone can help I’d greatly appreciate it. I feel like I’m at the finishing line, and I just can’t get over it. Everything else is done - DKIM signing, etc. Just not exactly sure I’m getting the gist of what I’m missing. The installation is very vanilla, and I’m only looking for low volume here (ie. 1 pool) and it runs on a very simple server. I tried to view the logs and they are all binary, and even after installing tools to try and read it, that didn’t work either.

Anyway can anyone point me in the right direction of what to check here?

Thanks
K

Hey there @welcoming-rabbit, thanks for posting. Please read the “Troubleshooting” and “How to Ask for Help” buttons below. If you would like a 1:1 support session from the KumoMTA team, details are at the “Book a Support Session” button below.

Have you tried using the tracer command to view the logs?

Apologies I mean tailer:

sudo /opt/kumomta/sbin/tailer --tail /var/log/kumomta | jq

Yes, for some reason it didn’t work. I think I have some Python issues. But having said that, if I review the journalctl logs, I just found something that could be the issue. it appears to want to send the email, but at the very end of the debug log - when I see it resolving DNS to the destination MX server, it shows “failed: invalid peer certificate: Other (UnsupportedCertVersion)”. Any idea what that could be from?

Yep.

Sharing your configs as requested above would be helpful but I am guessing you have TLS configured but the cert either has permission issues or it is not referenced properly.

Maybe disable TLS and test? Hard to tell without seeing your configs and logs

Thanks Tom. I think you are right. Everything else in the logs looks good, other than this TLS issue. I’ll check permissions.

I had some serious TLS issues, if you check my recent thread we may have talked about the solution. Personally I switched to LetsEncrypt with CertBot

Certbot make that so easy.

Unfortunately my server isn’t http facing the Internet - I have a second server for that. Only port 25 is exposed on it. I think trying to automate certbot renewal is going to be an issue.

What is the setting to turn off TLS while I test this? I can’t seem to see an option in init.lua other than to turn that off for the web server

You can do some kind of DNS auth with outbound API to your DNS provider

But honestly I’d just enable CertBot IPs to access port 80

I have not seen your config so it is hard to tell but just commenting out the TLS lines in the listener should do it

ok, i’ll give that a try

Reminder… Discord

@welcoming-rabbit Did this get resolved? If not, does this help?