Relaying denied revisited

Recently I was called about complaints of workflow mailer failing to send outgoing mails, after the database server failed over. We use the sendmail daemon of the database server as the mail server. On checking the /etc/hosts file of the server, I found that it did not have the entries for the application tier servers. Sendmail always checks if a host which is trying to send mail is present in the mail server's /etc/hosts file. After adding the servers, relaying denied was resloved.

As discussed in a previous post, Sendmail does these checks:

1. Checks whether the host trying to send mail is in /etc/hosts
2. Does a reverse DNS lookup on the IP of the host trying to send mail, to see if the name is same as that reported by the host. For example if the host reports its name as appserver.justanexample.com (based on /etc/hosts of mail server), but a reverse DNS lookup shows that the name of the server is appserver.dev.justanexample.com, then Sendmail will reject it with Relay Denied error

Where is the workflow notification mailer smtp and imap hostname stored in DB

This query tells you where the Workflow notification mailer is running:

select target_node
from apps.fnd_concurrent_queues
where concurrent_queue_name like 'WFMLRSVC%';

This query tells you the IMAP inbound server name, SMTP outbound server name, value of reply to email address:

SELECT b.component_name,
c.parameter_name,
a.parameter_value
FROM apps.fnd_svc_comp_param_vals a,
apps.fnd_svc_components b,
apps.fnd_svc_comp_params_b c
WHERE b.component_id = a.component_id
AND b.component_type = c.component_type
AND c.parameter_id = a.parameter_id
AND c.encrypted_flag = 'N'
AND b.component_name like '%Mailer%'
AND c.parameter_name in ('INBOUND_SERVER','OUTBOUND_SERVER', 'REPLYTO')
ORDER BY c.parameter_name;

550 5.7.1 Relaying Denied

This is one of the most common errors after setting up your mail server.   All mail servers deny relaying by default due to the worldwide problem of spams.  In Oracle Apps if you see this error in your workflow mailer notification logs or in /var/log/syslog, you should check for these:

The Workflow mailer works in this way:

A connection is made from application tier server to the mail server on port 25 (SMTP)

When the smtp server gets the mail from application server, it first checks whether the application server's IP exists in /etc/hosts of the sendmail server.  In our environments, we usually configure the concurrent tier as the mail server by starting the sendmail server on it.

Unless and until you have the entries for your application web servers in /etc/hosts, sendmail will not accept the mail for relay to any destination except its own domain.

For example, if I connect to port 25 and send a mail to a different domain

telnet vip.justanexample.com 25

Trying 192.168.1.17...

Connected to dbtier.justanexample.com

Escape character is '^]'.

220 physicalserver.justanexample.com ESMTP Sendmail 8.13.8+Sun/8.13.8; Sat, 15 Nov 2008 10:33:45 -0500 (EST)

MAIL FROM: john.doe@justanexample.com

250 2.1.0 john.doe@justanexample.com... Sender ok

RCPT TO: jane.doe@someotherdomain.com

550 5.7.1 jane.doe@someotherdomain.com... Relaying denied

However if the @ in the mail is the mail server name then relaying is ok.

RCPT TO: mailuser@vip.justanexample.com

250 2.1.5 mailuser@vip.justanexample.com... Recipient ok

The rule is 

1. Mail will be accepted from all IPs as long as the server name after the @ in email address is the mail server or the hostnames present in /etc/mail/local-host-names.  For our example, make sure that you have the logical and physical hostnames of all application servers and the DB cluster name in /etc/mail/local-host-names.

2. Mail will be accepted for relay from those IPs whose IP and hostnames are correctly mentioned in /etc/hosts file of the mail server in this format:

IP address   servername.domainname   servername

192.168.1.17    vip.justanexample.com    vip

If you take care of these two things, you'll not see the 550 5.7.1 Relaying denied message in Oracle Apps 11i.

Relaying denied

In one of our environments, the mail server was changed. Previously the SMTP server was configured as the Exchange Server. It was changed to Sendmail. However sending mail to any external domain was giving this error:

Relaying denied

A google search revealed a page about Controlling SMTP Relaying. However, none of the steps applied to us. Mail was working fine from other servers created with the very same OS image.

A simple smtp commandline test is to

First connect to the Apache/Forms tier with telnet

telnet apache.justanexample.com

Once you are logged in

telnet sendmail.justanexample.com 25

MAIL FROM:vikramdas@justanexample.com
RCPT TO:mailuser@justanexample.com

Relaying Denied.

However if I connected to a different server instead of connecting to apache.justanexample.com:

telnet qaserver.justanexample.com

telnet sendmail.justanexample.com 25

MAIL FROM:vikramdas@justanexample.com
RCPT TO:mailuser@justanexample.com

Recipient OK.

I am still investigating what is causing Relaying Denied error. As a workaround, we changed the configuration and pointed SMTP server field in workflow mailer configuration to a different sendmail server. We verified in the same way as described above. This worked. However I am still trying to find out what was causing the Relaying denied message from the previous server. I'll update this post once I find out.

Mail sent on clicking the Approve button in workflow mail bounces back with smtp error

In one of our dev environments, workflow approval mails were getting bounced with this message:

Your message did not reach some or all of the intended recipients.

Subject: Action Required: Purchase Requisition 14729 for Example, User (100.00 USD) requires approval
Sent: 5/23/2008 12:33 PM

The following recipient(s) could not be reached:

mail@erp4.justanexample.com on 5/23/2008 12:37 PM
A configuration error in the e-mail system caused the message to bounce between two servers or to be forwarded between two recipients. Contact your administrator.
<>

I googled for this smtp error and found that many people have suggested having all the names of the mail server in /etc/mail/local-host-names. I have asked unix team to do this change. However I am not very sure this will work, as we do not user local-host-names in our sendmail configuration in other dev servers.

Unix team came back saying that the smtp configuration works on all other servers and they would not change it. So I checked for other instances on the same box, and found that workflow notification mailer was working fine with some other instances using the very same smtp. I checked the workflow mailer configuration screens in OAM and found that smtp unix user and password were incorrect. Workflow mailer was not running at all. After this was corrected, the approval workflow mails started going in without bouncing back.