On 2007-11-12 at 22:06 +0900, Mark Fletcher wrote:
> AND THAT NAILED IT! You were right in the very beginning. The issue was
> the port -- I was getting a similarly unhelpful failure in the debug
> output on ssl_connect() when I used port 25, but when I switched to port
> 587, bingo -- my mobile phone started vibrating!
Gmail's servers only advertise STARTTLS on port 25 if your source IP
address is in a netblock setup to make it so, by an organisation paying
money for the Premier version of Google Apps for your Domain. I forgot
this at first and the double-check I did was from such a whitelisted IP.
Oops.
So if STARTTLS was advertised on port 25 then:
(a) lucky you, re Gmail, but unfortunately someone else is filtering
your outbound port 25 connections with forced-proxy
(b) it's not portable for other source IPs
The debug output which you already have will show if it was actually
advertised.
I don't think that there's a way to tell Exim to use SSL-on-connect for
outbound connections, so I can't really see how else Exim would have
started TLS and then failed.
-Phil
