KumoMTA internal: failed to connect to any candidate hosts: tls policy is Required but STARTTLS

get-help
41

yeah my point is that I don’t think it’s a firewall-type issue because it should fail on their as well?

42

whereas Gmail doesn’t even OFFER it on the SMTP connection

43

I’m honestly at a massive loss, I’ve never seen something like this before. Blacklisted IP maybe?

44

Yeah, I wonder if the IP of the host that doesn’t offer is consistent so it could be omitted from rotation.

45

oh like try a different Gmail endpoint? I can give it a shot, but based on the full error above it appears to be all of them

46

Strange.

47

huh. what’s weird is it inboxed gmail using SWAKS on that IP/domain

48

(I was thinking maybe it was related to like a really bad IP reputation or something…but apparently not?)

49

I guess I could configure Kumo to not require startTLS, but that feels like a bad idea. I thought Gmail required it so I’m shocked this worked

50

Yeah I’d say your easiest fix is to go to opportunistic.

51

https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F81126%3Fvisit_id%3D638598709632343256-3471037042&assistant_id=generic-unu&product_context=81126&product_name=UnuFlow&trigger_context=a

yeah, supposedly the requirement to use TLS started in December

52

oppertunistic means it won’t REQUIRE the StartTLS response in Kumo right? so it would work just without TLS

53

If there’s TLS advertised it will use it, otherwise plaintext.

54

I think turning off tls is the wrong move here. Need to figure out why it is not being advertised to you

55

I agree, I just wanted to understand the options

56

Is there a scenario where the cause of it not being advertised is in our control?

57

I have a hunch, but need to wait for the client to get back to me

58

it’s not in our control

59

if it’s the case, KumoProxy may be the answer. They’re doing some routing funkiness here. and I bet Gmail doesn’t like it.

60

it’s possible that they decide not to show it based on IP and/or EHLO domain