Please turn on SMTP Authentication in your mail client errors

[Domenico]

All of a sudden customers on different servers get the following error:

SMTP error from remote mail server after RCPT TO:<[email protected]xxx>:
550-Please turn on SMTP Authentication in your mail client, or login to
the
550-IMAP/POP3 server before sending your message.​

All have SMTP Authentication turned on. What now?

 

[Domenico]

As expected, enabling WHM > Service Configuration > Exim Configuration Manager: "Allow weak SSL/TLS ciphers"? helps.

How to explain customers who don't know anything about this to fix this within Outlook?

And, what changed last night that made this happen?

 

[SysSachin]

May be you can fix this by installing the ssl on your incoming and outgoing mail server.

That is hostname of the server. Have the ssl installed on the hostname of the server. You will not get the error.

 

[Domenico]

May be you can fix this by installing the ssl on your incoming and outgoing mail server.

That is hostname of the server. Have the ssl installed on the hostname of the server. You will not get the error.

Thanks but that is not the issue. SSL certificates are installed and working fine.

 

[cPWilliamL]

Hi @Domenico,

In cPanel 66, we disabled the weak/outdated Triple DES ciphers(CPANEL-11108):
66 Change Log - Change Logs - cPanel Documentation

Obviously, it would be best if the users would update their mail client/OS, but I'm sure it's not easy to get your users to do this. Below is the relevant blog entry about the vulnerability(CVE-2016-2183):
The SWEET32 Issue, CVE-2016-2183 - OpenSSL Blog

Thanks,

 

[Domenico]

Hi @Domenico,

In cPanel 66, we disabled the weak/outdated Triple DES ciphers(CPANEL-11108):
66 Change Log - Change Logs - cPanel Documentation

Yes but this server is on v68.0.14 already and yesterday everything was fine but this morning all of a sudden customers started complaining. So, what could be the cause of this?

 

[cPWilliamL]

What does the recent update history look like(/var/cpanel/updatelogs/summary.log)?

We did make a TLS change in 68, but this should only affect new installs. Do you have backups to confirm a change? If so, please open a ticket with us so we can investigate.
68 Release Notes - Version 68 Documentation - cPanel Documentation

 

[Domenico]

[2017-11-15 03:51:36 +0100] Completed update 11.68.0.13 -> 11.68.0.14

So this must be the culprit. I guess I better open a ticket so you can check.

 

[Domenico]

So, this was the solution.

"After reviewing the mail logs I do see that this behavior appears to affect many users:

[15:46:42 neo [email protected] ~]cPs# exigrep "Please turn on SMTP Authentication in your mail client," /var/log/exim_mainlog|awk '{print $3}'|sort|uniq|wc -l
749

Typically the solution to this behavior is to disable SMTP Restrictions and re-enable them.

SMTP Restrictions - Documentation - cPanel Documentation"​

I guess cPanel doesn't know either...

 

[renej]

Typically the solution to this behavior is to disable SMTP Restrictions and re-enable them.

This seems to have worked for me. I had to disable DKIM in cPanel - EMAIL - AUTHENTICATION and then enable it again.

 

[Rojanau]

This seems to have worked for me. I had to disable DKIM in cPanel - EMAIL - AUTHENTICATION and then enable it again.

This worked for me too! Bizarre!!

1. Changed cPanel from Local to Remote Mail Exchanger
2. Changed MX away from cPanel to a different MX server..
3. Changed Autodiscover record
4. Started to get 550 SMTP Authentication errors from some places.. not all
5. Removed DKIM + SPF Record. Same issue!!!
6. Found this article. RE-enabled DKIM only. Did NOT RE-enable SPF record.
7. All Fixed!! No more 550 SMTP Authentication 'cannot relay to this server' error...

Thanks

Michael

 

[cPanelMichael]

Hello @Rojanau,

Can you let us know the steps you were taking to reproduce the 550 SMTP authentication error? If a domain name is configured with remote MX records and email is handled by a remote mail server, you'd generally avoid sending out email through the cPanel server and instead use the remote mail server to send the emails.

Thank you.

 

[Scott Aadal]

Hello,

I am having the same issue with WHM on Google cloud with G suite. Migrated an instance yesterday and thought everything was perfect until today where I am getting : 550 Please turn on SMTP Authentication in your mail client, or login to the IMAP/POP3 server before sending your message. mail-oi1-f179.google.com [209.85.167.179]:35055 is not permitted to relay through this server without authentication.

Service manager has smtp enable, SRS enabled. Anything new here.

 

[cPanelMichael]

Hello @Scott Aadal,

Check to ensure the SPF record matches exactly what Google recommends at:

Configure SPF records to work with G Suite - G Suite Administrator Help

Additionally, can you verify the domain name exists in the /etc/remotedomains file on the system?

Thank you.

 

[Scott Aadal]

Hi @cPanelMichael,

Good call! After digging the domain I noticed that DNS records were pointed to the registrar and the registrar did not have MX records set. Thus throwing DKIM & SPF errors. Just an A record (this is what I get for migrating after midnight). Since Google has a 5 min TTL through cloud dns I figure its worth a shot (I have no mail). By the time I wrote this Google DNS populated.

All fixed! Thanks so much.

SA

 

[cPanelMichael]

Hi Scott,

I'm glad to see it worked out. Thanks for sharing the outcome!

 

[Webrockhost]

Not sure if this is entirely the same but we experience a simular issue on many servers.

After a reboot we need to toggle a setting in the exim configurator to get rid of the " 550-Please turn on SMTP Authentication in your mail client" error.

Since we have a lot of servers this causes a lot of problemen, more so if servers reboot on themself because of some other issue and customers start complaining they can't send mail.

After we change a setting in the exim configuration editor and save it, the authentication starts working again...

Since we have this on many servers others must have experienced the same?

 

[cPanelMichael]

Hello @Webrockhost,

Could you open a support ticket so we can take a closer look at one of the affected systems to see why saving the Exim configuration was required to solve the issue? You can post the ticket number here and we'll update this thread with the outcome.

Thank you.

 

[cPanelMichael]

Hello Everyone,

We recently published Troubleshooting "550 Please turn on SMTP Authentication in your mail client" with a list of the most common reasons this error message occurs. Let us know if this resource is helpful.

Thank you.

 

[mramirshaikh]

Hello Everyone,

We recently published Troubleshooting "550 Please turn on SMTP Authentication in your mail client" with a list of the most common reasons this error message occurs. Let us know if this resource is helpful.

Thank you.

Thank you for this, helped me fix the issue.