On Thu, Aug 27, 2015 at 03:23:37PM +0100, Gary Stainburn wrote:
> I did have a number of delay statements in my config as suggested in various
> anti-SPAM pages over many years. I have reduced them signigicantly but that
> also hasn't made any difference.
I just tried:
$ posttls-finger ringways.co.uk
posttls-finger: Connected to mail.ringways.co.uk[88.211.105.31]:25
posttls-finger: < 220 mail.ringways.co.uk ESMTP Exim 4.84 Thu, 27 Aug 2015 15:36:49 +0100
posttls-finger: > EHLO mournblade.imrryr.org
posttls-finger: < 250-mail.ringways.co.uk Hello mournblade.imrryr.org [38.117.134.19]
posttls-finger: < 250-SIZE 104857600
posttls-finger: < 250-8BITMIME
posttls-finger: < 250-PIPELINING
posttls-finger: < 250-STARTTLS
posttls-finger: < 250 HELP
posttls-finger: > STARTTLS
posttls-finger: < 220 TLS go ahead
posttls-finger: SSL_connect error to mail.ringways.co.uk[88.211.105.31]:25: Connection timed out
Are you using /dev/random, rather than /dev/urandom for entropy?
There was a long pause after "220 TLS go ahead" and then a timeout.
Turning on "debug" logging shows that the timeout is right after
the TLS client HELLO.
$ posttls-finger -Ldebug ringways.co.uk
posttls-finger: initializing the client-side TLS engine
posttls-finger: Connected to mail.ringways.co.uk[88.211.105.31]:25
posttls-finger: < 220 mail.ringways.co.uk ESMTP Exim 4.84 Thu, 27 Aug 2015 15:39:27 +0100
posttls-finger: > EHLO mournblade.imrryr.org
posttls-finger: < 250-mail.ringways.co.uk Hello mournblade.imrryr.org [38.117.134.19]
posttls-finger: < 250-SIZE 104857600
posttls-finger: < 250-8BITMIME
posttls-finger: < 250-PIPELINING
posttls-finger: < 250-STARTTLS
posttls-finger: < 250 HELP
posttls-finger: > STARTTLS
posttls-finger: < 220 TLS go ahead
posttls-finger: setting up TLS connection to mail.ringways.co.uk[88.211.105.31]:25
posttls-finger: SSL_connect:before/connect initialization
posttls-finger: SSL_connect:SSLv2/v3 write client hello A
... delay ...
posttls-finger: SSL_connect error to mail.ringways.co.uk[88.211.105.31]:25: Connection timed out
So either you have MTU or other network issues with sending the
server TLS HELLO etc. or your server is not producing "entopy"
quickly enough, because you're using /dev/random instead of
/dev/urandom as your randomness source for seeding TLS.
--
Viktor.
