Can't bounce email (SMTP permission issue)

[HervE]

Hello forum,

I get an error whenever I try to Bounce an email:

[Thu Sep 18 16:59:46 2014][Error][Kernel::System::Email::SMTP::Send][155] Can't send message: 550Start mail input; end with <CRLF>.<CRLF>
5.7.1 Client does not have permissions to send as this sender
! Enable Net::SMTP debug for more info!

(Actually, I manage to bounce an email... provided that it is a mail from the system in response to a customer, which of course is no interest!)

My guess is, it is due to the encryption method: TLS.
Could anyone confirm?

Best regards,
HervE

[crythias]

Client does not have permissions to send as this sender

Means ... the sender email address is being used with an account authenticating with SMTP that the authenticating account is not allowed to send as.

[HervE]

Oh, I forgot to mention that sending mail works fine in all other cases than 'bounce', i.e. reply, forward, notification.

Is "bounce" a different functionality that requires different permissions?

HervE

[crythias]

Is "bounce" a different functionality that requires different permissions?

You should be able to determine the sender address and answer this question.

[HervE]

So you mean the answer to my question is 'yes'.
Yet I need it to be clarified. In the very principle of "bounce" function, the sender address is the one of the original mail, so necessarily it is not supposed to be sent by the host SMTP, right?
However, I have already seen it work in the past. So, what makes bounce work, or not work? What kind of permissions are needed? How can I check that? (Sorry for my poor knowledge of mailing mechanism...)

And I'm back to my first question: Does TLS encryption method prevent such a thing like OTRS bounce function?

Regards,
HervE

[crythias]

We seem to be missing each other in what we're trying to say.

On the one hand, there's no permission difference between a bounce and a reply.
On the other hand, if the sender address is different between a bounce (from the system) and a reply (from the queue), and that address is not authorized under the SMTP credentials, the error will show up.

This is not specific to TLS. It's specific to the authentication for SMTP.

[HervE]

We seem to be missing each other in what we're trying to say.

I've got the same feeling.
I beg your pardon, for I'm not used to these techniques so I may not use the appropriate vocabulary. (Let alone the language barrier, that I do my best to jump over!)

To understand each other better, I suggest we focus on something concrete: error message, logs, data, facts, examples...
Which elements could I provide you with, in order to analyse - and hopefully solve - the issue?

Here is a log extract:
[Fri Sep 19 09:15:12 2014][Notice][Kernel::System::Email::Bounce] Bounced email to toto@hisfirm.fr' from 'otrs@myfirm.fr'. MessageID => '<6DCBCB398ED5904AA1C2914D05E00C200156F3B8E0@server.exchange.local>
';
[Fri Sep 19 09:15:16 2014][Error][Kernel::System::Email::SMTP::Send][155] Can't send message: 550Start mail input; end with <CRLF>.<CRLF>
5.7.1 Client does not have permissions to send as this sender

Regards,
HervE

[crythias]

otrs@myfirm.fr is the sender.
The SMTP authentication doesn't allow that sender.

[HervE]

So how do you explain it does allow this sender for reply, forward and notification?
For this "otrs@myfirm.fr" is the only system address, and applies for all queues.

Regards,
HervE

[crythias]

Check your exchange logs.

[HervE]

Do you say that because you saw @server.exchange.local in the MessageID?

The MessageID suffix has to do with the original sender of the message I'm trying to bounce, not with the actual sending process.

For instance, here is another example somewhere else in the log file:
[Thu Sep 18 16:09:16 2014][Notice][Kernel::System::Email::Bounce] Bounced email to 'barack@whitehouse.com' from 'otrs@myfirm.fr'. MessageID => '<1713189017.76799488.1411049368406.JavaMail.root@zimbra94-e16.priv.proxad.net>
';
[Thu Sep 18 16:09:20 2014][Error][Kernel::System::Email::SMTP::Send][155] Can't send message: 550Start mail input; end with <CRLF>.<CRLF>
5.7.1 Client does not have permissions to send as this sender

Regards,
HervE

[crythias]

The error message comes from your SMTP server. Start there.

[HervE]

Yes, that's it.

'A' wrote a message to otrs@myfirm.fr, so the message is "From 'A' to otrs@myfirm.fr"
Bouncing this message to 'B' should lead 'B' to receive a message still mentioned "From 'A' to otrs@myfirm.fr"... although 'A' never wrote to 'B'.
So otrs@myfirm.fr must have the permission to send as 'A'.

As I understand, there is an option somewhere in the SMTP server that refuses this permission to "send as".
Am I right?

Unfortunately, I am not the administrator of the SMTP server. A subcontractor is.
And I'm not sure I'll manage to have this permission...

Regards,
HervE

[crythias]

The notification sender address in SysConfig may be different from the Queue's system address

[HervE]

Yes, I know it can be. But it my case it is not.

Regards,
HervE

[crythias]

This error message is from your SMTP provider.
It is not an OTRS error.
It can't be fixed within OTRS until the SMTP provider gives more and specific information on why it's blocking.
It cannot be fixed from this forum.
I can't provide any additional information on this issue because the issue is from your SMTP provider, even if you swear, claim, assert, that there is no difference in sender email address, the SMTP provider does not agree with you.

[HervE]

I understand the problem is at SMTP server.

I was just replying to you because you said "otrs@myfirm.fr is the sender. The SMTP authentication doesn't allow that sender." It does indeed, because it lets this sender reply, forward and notify.

But bounce is different, because like I said otrs@myfirm.fr must have the permission to send as another email address.
As I understand, there is an option somewhere in the SMTP server that refuses this permission to "send as".

In my opinion, the error message "5.7.1 Client does not have permissions to send as this sender" was not clear enough. But OTRS may probably not be responsible of this message, like you said.

I will have to ask my mail administrator. If I manage to get some relevant information, I'll post it here.

Regards,
HervE

[crythias]

"5.7.1 Client does not have permissions to send as this sender" was not clear enough

Whether it is clear to solve is a matter of perspective. There is a permission set with the SMTP authentication permissions. Whatever is used at that point determines the account and send as permissions that are allowed.

There's no point in asserting that "it isn't the case that the From address is different" because the SMTP server doesn't agree that the sender address is the same one that is authorized to send via SMTP permissions.

[Liwh]

You can check the sender email in Admin > SysConfig > Framework > Core , with field NotificationSenderEmail:

This field depict the sender address for Auto Notification email. Checking whether it's same with your Core::sendmail

Regards,
Liwh