Demo
Demo

Knowledge base

PMTA knowledge base›Mechanism§ 1.7

Cloud restrictions

hosting PowerMTA in public cloud
Port 25 is closed until you ask

Large clouds put protection against spam sent from their machines.

Outbound port 25 is restricted until you ask: in AWS the restriction is lifted with a support request; the manual notes that Google and Azure work the same way. Messages simply do not leave in the meantime.

Cloud ranges have lower reputation: mailbox providers remember that spam was sent from them. You do not control your ranges in the cloud — in AWS Elastic IP addresses are not issued consecutively and come five per account per region until you ask for more; you can bring your own warmed-up addresses (BYOIP).

The main trap is looking for the cause in the configuration. When the cloud holds outbound port 25, the node is configured correctly, queues grow, and the log shows connection errors to receiving servers: the restriction is outside, and only a request to the provider lifts it.
What the Hub does. The Hub’s machine suitability check does not cover this: lifting the outbound port 25 restriction and choosing addresses are up to whoever adds the node. The Hub checks inbound port 25 for receiving reports on every configuration apply.
Recommended values

What to check before the first campaign from a cloud:

What What skipping it risks
whether the outbound port 25 limit is lifted messages do not leave at all
how many addresses the region allows not enough addresses for the warm-up plan
which range the addresses come from the low reputation of a cloud range
The port 25 restriction, the Elastic IP address limit and the note on cloud range reputation come from the manual (§ 1.7). The list of checks is ours.
Example configuration
# whether an external receiving server answers on port 25 from this machine
nc -vz -w 5 gmail-smtp-in.l.google.com 25
A timeout on a working network is the first sign that the cloud is holding the outbound port.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

2 relations

Affects

Prepare a machine for the engineThe procedure in which the mechanism is applied. § 1.7

Applies to

Deployment in the cloudThe procedure in which the mechanism is applied. § 1.7.1.1

Referenced from

How to turn a sending plan into hardwareIn the cloud the estimate gets something of its own on top: promised resources and available ones are not always the same thing. § 1.7.1.2

How to check on the node
Check outbound port 25 and how the node connects:
nc -vz -w 5 gmail-smtp-in.l.google.com 25
pmta resolve --connect gmail.com
If resolve finds the mail hosts but no connection to any of them succeeds, the restriction is outside the node.
◇

What else to read

3 articles

◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.◇How to turn a sending plan into hardwareTwo constants for sizing any node: about 2 KB of memory per queued recipient and spool space proportional to the total size of the messages.◇A license for a fleet, not for a serverThe license is not bound to a server: it is installed on as many machines as the instance limit allows, and the nodes send volume statistics to the vendor every hour.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Capacity planning · Prepare a node for sending · Sending through proxies