Webmail sends email but SMTP does not

[Deker]

Today our exim was dead and we couldn't get it back online without reinstalling it.
Now we and our clients are not able to connect to SMTP anymore.
Webmail works just fine, but smtp is not.
For example sending email from outlook to my gmail.com returns the following error, but sending email from webmail to the exact same email address works fine.

 503 Valid RCPT command must precede DATA

I tried both ports 25 and 587. both are open in the firewall.
How can I solve this?
I also ran a force cpanel update but it didn't help.

 

[cPanelLauren]

Hi @Deker

Are you using any 3rd party software like ASSP or mailscanner? Is there anything in

/etc/exim.conf.local

 

[Deker]

Hi @cPanelLauren
No we are not using any 3rd party software.
There is no exim.conf.local file in /etc directory.

 

[cPanelLauren]

Hi @Deker

That's good, actually. Are you using cPHulk? Do you have root access to the server? If so can you please check the exim logs at:

/var/log/exim_mainlog

 

[Deker]

Hi @cPanelLauren
CPHulk is disabled.
Yes I have root access to the server.
Here is the latest lines of exim log file:

2018-10-09 21:13:24 1g9yqi-21CGzr-CC SMTP connection outbound 1539117804 1g9yqi-21CGzr-CC **EDITED**.com [email protected]**EDITED**.com
2018-10-09 21:13:24 1g9yqi-21CGzr-CC ** [email protected]**EDITED**.com R=fail_remote_domains: The mail server could not deliver mail to [email protected]**EDITED**.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns e$
2018-10-09 21:13:24 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1g9yqi-21CGzr-CC
2018-10-09 21:13:24 1g9yqi-21CGzw-EG <= [email protected]**EDITED**.com U=dhlme P=local S=1505 [email protected]**EDITED**.com T="\332\251\331\276\333\214 \330\247\330\262: \320\262o\320\267\321\214\320\274\320\270\321\202\320\2$
2018-10-09 21:13:24 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1g9yqi-21CGzw-EG
2018-10-09 21:13:24 1g9yqi-21CH02-FB <= <> R=1g9yqi-21CGzr-CC U=mailnull P=local S=2805 T="Mail delivery failed: returning message to sender" for [email protected]**EDITED**.com
2018-10-09 21:13:24 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1g9yqi-21CH02-FB
2018-10-09 21:13:24 1g9yqi-21CGzr-CC Completed
2018-10-09 21:13:24 1g9yqi-21CGzw-EG Sender identification U=dhlme D=**EDITED**.com [email protected]**EDITED**.com
2018-10-09 21:13:24 1g9yqi-21CGzw-EG SMTP connection outbound 1539117804 1g9yqi-21CGzw-EG **EDITED**.com [email protected]
2018-10-09 21:13:24 1g9yqi-21CH02-FB Sender identification U=mailnull D=-system- S=mailnull
2018-10-09 21:13:24 1g9yqi-21CH02-FB ** [email protected]**EDITED**.com R=fail_remote_domains: The mail server could not deliver mail to [email protected]**EDITED**.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entri$
2018-10-09 21:13:24 1g9yqi-21CH02-FB Frozen (delivery error message)
2018-10-09 21:13:24 SMTP connection from [127.0.0.1]:60684 (TCP/IP connection count = 4)
2018-10-09 21:13:24 SMTP connection from (localhost) [127.0.0.1]:60684 closed by QUIT
2018-10-09 21:13:25 SMTP connection from [**EDITED-IP**]:62611 (TCP/IP connection count = 4)
2018-10-09 21:13:25 no host name found for IP address **EDITED-IP**
2018-10-09 21:13:26 H=(DESKTOP76OJ1H4) [**EDITED-IP**]:62611 sender verify fail for <[email protected]**EDITED**.com>: The mail server could not deliver mail to [email protected]**EDITED**.com.  The account or domain may not exist, they may be blacklisted,$
2018-10-09 21:13:26 H=(DESKTOP76OJ1H4) [**EDITED-IP**]:62611 F=<[email protected]**EDITED**.com> A=dovecot_login:[email protected]**EDITED**.com rejected RCPT <**EDITED**@yahoo.com>: Sender verify failed
2018-10-09 21:13:29 H=(DESKTOP76OJ1H4) [**EDITED-IP**]:62611 Warning: "Detected session with all messages failed"
2018-10-09 21:13:29 H=(DESKTOP76OJ1H4) [**EDITED-IP**]:62611 Warning: "Increment slow_fail_block Ratelimit - (DESKTOP73OJ1H4) [**EDITED-IP**]:62611 because of all messages failed"
2018-10-09 21:13:29 SMTP connection from (DESKTOP76OJ1H4) [**EDITED-IP**]:62611 closed by QUIT
2018-10-09 21:13:30 SMTP connection from ip152.ip-167-114-181.net [167.114.181.152]:61319 lost D=10s
2018-10-09 21:13:30 1g9yqi-21CGzw-EG => [email protected] R=dkim_lookuphost T=dkim_remote_smtp H=mxs.mail.ru [94.121.180.31] X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 OK id=1g9yqm-2107dA-QI"
2018-10-09 21:13:30 1g9yqi-21CGzw-EG Completed
2018-10-09 21:13:30 SMTP connection from [167.114.181.152]:61927 (TCP/IP connection count = 3)
2018-10-09 21:13:30 SMTP connection from [94.121.177.75]:52166 (TCP/IP connection count = 4)
2018-10-09 21:13:32 SMTP connection from ip152.ip-167-114-181.net [167.114.181.152]:61459 lost D=10s
2018-10-09 21:13:33 SMTP connection from [167.114.181.152]:62081 (TCP/IP connection count = 4)
2018-10-09 21:13:41 SMTP connection from ip152.ip-167-114-181.net [167.114.181.152]:61927 lost D=10s

Any hope we can handle this issue?

 

[Anupam SG]

The following IP from the log - which is connecting through SMTP to send email through the server - is blacklisted

167.114.181.152

Network Tools: DNS,IP,Email

Try logging in from a different IP address to see if it helps.

Also: SOLVED - 503 Valid RCPT command must precede DATA