PanelDOCSv1.0.0

Outgoing mail relay

Send the server's outgoing mail through an SMTP relay when your provider blocks outgoing port 25.

A mail server normally delivers each message itself, by connecting to the recipient's mail server on port 25. Many cloud and VPS providers block outgoing port 25 to stop spam from new servers. With an outgoing mail relay (also called a smarthost), HF Panel hands every outgoing message to another mail server that you sign in to, on port 587 or 465, and that server delivers it.

Where: Server Admin › Email › Server mailboxes › Outgoing mail relay card

When you need it

  • The post-install check (hf-agent smoke-test) says outgoing port 25 is blocked, and your provider can't or won't open it. The provider guides say which providers block it.
  • Mail sent from the server waits in the queue with errors such as "Connection timed out" on port 25 (see Mail delivery log).
  • You prefer a mail-sending service to deliver for you, for example to use its sending reputation.

Receiving mail is not affected: other servers still deliver to your server on port 25 (incoming), which providers do not block.

Set up the relay

  1. Get SMTP credentials from a mail-sending service. Many email-sending services, and most mailbox providers, give you an SMTP host name, a port, a username and a password (often an API key).
  2. Open Server Admin › Email › Server mailboxes and find the Outgoing mail relay card.
  3. Tick Use a relay and fill in the fields.
  4. Click Save. HF Panel sets up the mail server and reloads it; nothing else needs restarting.
  5. Under Send a test email, enter an address you can read and click Send test.
Field What to enter
Host name or IP address the relay's SMTP server, for example smtp.example.com
Port 587 · STARTTLS (the usual choice), 465 · TLS (encrypted from the start), 25 · STARTTLS or 2525 · STARTTLS (when the service offers it because 587 is blocked)
Username the SMTP username the service gives you: often your address, a fixed name such as apikey, or a key
Password the SMTP password or API key. It is stored encrypted with the server's own key and never shown again; leave the field empty to keep the saved one

The connection to the relay is always encrypted, and HF Panel refuses to send the password over an unencrypted connection. Only the server's root user can read the stored login.

Note: DKIM keeps working. Each message is signed with your domain's DKIM key when the server accepts it, before it is handed to the relay.

Make the relay's mail trusted

Receiving servers check that the relay may send for your domains:

  • SPF: add the service to the SPF record of every domain that sends mail through the relay. The service tells you what to add, usually an include: such as v=spf1 mx include:spf.example.com ~all.
  • Sender domains: most services want each sending domain verified in their dashboard first. Until it is, they refuse or rewrite the sender.
  • DKIM: keep the hf._domainkey record HF Panel made. If the service also signs, add its DKIM record too.

See Mail health for the checks HF Panel runs on your domains.

Test and troubleshoot

Send test sends a short message the same way all outgoing mail leaves and waits up to 30 seconds for the answer:

Message What it means
Test email sent. the relay accepted the message; check the inbox (and the spam folder)
The test email is waiting in the mail queue no answer yet; look in Mail delivery log a minute later
"can't connect to the relay … port …" wrong host or port, or your provider also blocks that port: try another port the service offers
"SASL authentication failed" wrong username or password
"Sender address rejected" or "not verified" verify the sending domain with the service

The post-install check also tests the relay: with a relay set, hf-agent smoke-test checks that the relay's host and port answer instead of checking port 25.

Turn the relay off

Untick Use a relay and click Save. The server sends mail directly again; the relay's settings are kept, so you can turn it back on later without typing them again.