SOLVED exim sending problem - "a TLS session is required, but the server did not offer TLS support"

[tecnico_metarete]

I see exim errors sending from mails from WHM users to @protonmail.ch and @virusfree.cz.

The error is:

2022-07-28 15:36:20.191 [63730] 1oGHhd-******-** H=mail.protonmail.ch [185.205.70.128]:25: a TLS session is required, but the server did not offer TLS support
2022-07-28 15:36:26.139 [63730] 1oGHhd-******-** H=mail.protonmail.ch [185.70.42.128]:25: a TLS session is required, but the server did not offer TLS support
2022-07-28 15:36:26.335 [63730] 1oGHhd-******-** H=mailsec.protonmail.ch [185.205.70.129]:25: a TLS session is required, but the server did not offer TLS support
2022-07-28 15:36:26.534 [63730] 1oGHhd-******-** H=mailsec.protonmail.ch [185.70.42.129]:25: a TLS session is required, but the server did not offer TLS support
2022-07-28 15:36:26.536 [63728] 1oGHhd-******-** == ********@protonmail.com R=dkim_lookuphost T=dkim_remote_smtp defer (-38) H=mailsec.protonmail.ch DS [185.70.42.129]:25 I=[46.254.37.78]:50116 DT=0.198s: a TLS session is required, but the server did not offer TLS support

Is there in exim configuration some kind of parameter to solve this TLS negotiation problem?
Thanks,
Carlo

 

[cPRex]

Hey there! This seems like an issue with the remote mail services, if I'm reading these logs correctly. Those servers are the ones indicating the particular type of session is required, not your local machine.

If you have made any customizations to Exim, you can use the WHM >> Exim Configuration Manager page to backup your current configuration and reset the server settings to the defaults. That is an easy test to see if things start working - if not, the problem would not be on your server but on the remote system.

 

[tecnico_metarete]

If you have made any customizations to Exim, you can use the WHM >> Exim Configuration Manager page to backup your current configuration and reset the server settings to the defaults. That is an easy test to see if things start working - if not, the problem would not be on your server but on the remote system.

Thank you cPRex, I tried your solution (all the restore options...) but the problem persists so I restored the current exim configuration.

The problem is on this server for sure because I get STARTTLS error every time I use this server to initiate a SMTP session.

I have:

1. serverA[DOT]com: the WHM server with the problem
2. mailsec[DOT]protonmail[DOT]ch
3. serverB[DOT]com: another mail server I can use for tests

From serverA[DOT]com to mailsec[DOT]protonmail[DOT]ch: ERROR

[email protected][DOT]com [~]# nc -v mailsec[DOT]protonmail[DOT]ch 25
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 185.205.70.129:25.
220 mailin004[DOT]protonmail[DOT]ch ESMTP Postfix
STARTTLS
500 5.5.1 Invalid command

From serverA[DOT]com to serverB[DOT]com: ERROR

[email protected][DOT]com [~]# nc -v serverB[DOT]com 25
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to xx.xx.xx.xx:25.
220 serverB[DOT]com ESMTP Postfix (Ubuntu)
STARTTLS
500 5.5.1 Invalid command

From serverB[DOT]com to mailsec[DOT]protonmail[DOT]ch: OK

[email protected][DOT]com:~# nc -v mailsec[DOT]protonmail[DOT]ch 25
Connection to mailsec[DOT]protonmail[DOT]ch 25 port [tcp/smtp] succeeded!
220 mailin004[DOT]protonmail[DOT]ch ESMTP Postfix
STARTTLS
220 2.0.0 Ready to start TLS

Any other suggestion?
Thanks,
Carlo

 

[cPRex]

Thanks for that detailed reply. I don't have any other ideas off the top of my head, so it might be best to submit a ticket to our support team so we can take a look at that, as that is one of those functions that should just work out of the box.

 

[tecnico_metarete]

Ticket already opened,
thank you,
Carlo

 

[cPRex]

Can you post the ticket number here?

 

[tecnico_metarete]

Can you post the ticket number here?

Sure: #94470276

Thanks,
Carlo

 

[cPRex]

Thanks for posting that - I'm following along with that ticket on my end now.

 

[tecnico_metarete]

Thanks for posting that - I'm following along with that ticket on my end now.

Thank you very much,
Carlo

 

[cPRex]

Our team made the following support article to help with this, in case this helps anyone else in the future:

https://support.cpanel.net/hc/en-us/articles/7961026457239-Exim-error-a-TLS-session-is-required-but-the-server-did-not-offer-TLS-support

 

[tecnico_metarete]

Thank you very much,
problem solved,
very professional support,
Carlo

 

[cPRex]

You're very welcome!