Debugging SMTP Connection Issues on a cPanel Server with CSF Firewall Enabled

Your application tries to send email through an outside SMTP server, such as Microsoft 365 or Gmail, and fails with Connection timed out (110). The message is the same whatever the cause, so the useful work is finding out which layer drops the connection: the firewall, IPv6 routing, PHP or the application's settings. This guide covers what you can check on shared hosting and, separately, how to debug it on a cPanel server you run yourself with the CSF firewall.

1. Read the error first

Fix the error you actually have: a firewall change fixes neither an authentication failure nor a disabled function.

2. On Domain India shared hosting

On shared hosting (cPanel, DirectAdmin or Webuzo), the firewall belongs to the server, not your account. You can't view its rules, and neither CSF nor its logs are visible from your panel. What you can do:

• Check for a disabled-function error first. On our cPanel servers, fsockopen, stream_socket_client and socket_create are disabled, so PHPMailer in SMTP mode, Laravel's SMTP mailer and SMTP plugins can't open a connection at all. On DirectAdmin, test on your plan. See PHP disabled functions on shared hosting.
• Use the route that works. PHP mail() with the -f envelope sender sends through the server's own mail system; PHPMailer can build the message and hand it to mail(). An email provider's HTTPS API is the other option. Both are explained in Sending email from PHP and How to use PHPMailer for contact forms.
• Watch your limits. Outgoing mail is limited to 200 messages per hour per account on cPanel and 1,000 per day on DirectAdmin.
• Ask us to check the network side. If you still get a timeout, open a ticket with the SMTP host and port you are connecting to, the exact error, and the time it happened. Don't try to work around the server firewall.

If your application must send through an outside SMTP server, run it where you control the network: a VPS or the App Platform.

The rest of this guide is for your own server with root access.

3. Own server: test the network path

Test from the server itself, over IPv4 and IPv6 separately:

nc -vz -4 -w 10 smtp.office365.com 587
nc -vz -6 -w 10 smtp.office365.com 587

If IPv4 connects and IPv6 times out, the problem is IPv6 routing (section 5). If both time out, suspect the firewall (section 4). If the host doesn't resolve, check DNS with dig +short smtp.office365.com before anything else.

Then check that STARTTLS and the certificate work:

openssl s_client -starttls smtp -connect smtp.office365.com:587 -brief </dev/null

swaks goes one step further and runs a full test send with authentication, which shows the exact SMTP reply if the login fails.

4. Own server: check the firewall

On a cPanel server with CSF, three things commonly block outbound SMTP:

• SMTP_BLOCK. When it is on, only root and the mail server may make outgoing SMTP connections; scripts running as ordinary users are dropped. SMTP_ALLOWUSER and SMTP_ALLOWGROUP exempt named users.
• Outbound port rules. If the submission port is not in the outbound allowed list, connections to it are dropped.
• Deny entries. csf -g 587 and csf -g PROVIDER_IP show which rules match.

After changing CSF, reload it with csf -r and repeat the nc test. Note that ConfigServer stopped developing CSF in 2025. For a new server, use firewalld, ufw or nftables with fail2ban instead; the same principle applies: allow outbound SMTP for the mail server, not for every user.

5. IPv6: fix the route, don't switch it off

Many providers publish IPv6 addresses. If your server has an IPv6 address but no working IPv6 route, connections try IPv6 first and hang. Check:

ip -6 route show default
curl -6 -sI https://www.google.com | head -1

If there's no default route or the test fails, fix the IPv6 configuration with your host. Until then, you can make the system prefer IPv4 for outgoing connections by adding this line to /etc/gai.conf:

precedence ::ffff:0:0/96  100

This keeps IPv6 available for services that use it, unlike disabling IPv6 with sysctl, which can break services listening on IPv6 and hides the real fault.

6. Own server: test from PHP

A command-line test can pass while PHP still fails, because PHP-FPM may run as a different user and CSF's SMTP_BLOCK applies to that user. Test as the site's user:

<?php
$host = 'smtp.office365.com';
$port = 587;
$ctx  = stream_context_create(['socket' => ['bindto' => '0:0']]); // force IPv4 for this test
$fp   = @stream_socket_client("tcp://$host:$port", $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $ctx);
echo $fp ? "Connected\n" . fgets($fp) : "Failed: $errstr ($errno)\n";

Run it with sudo -u SITEUSER php test-smtp.php, then delete the file. If it connects from the command line but times out here, the firewall is treating that user differently.

7. Laravel settings

Keep the configuration simple and keep TLS verification on:

MAIL_MAILER=smtp
MAIL_HOST=smtp.office365.com
MAIL_PORT=587
[email protected]
MAIL_PASSWORD=your-password
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="${APP_NAME}"

On port 587 the mailer negotiates STARTTLS by itself. Older Laravel versions also use MAIL_ENCRYPTION=tls; newer ones use MAIL_SCHEME instead; follow the config/mail.php of your version. After any change run php artisan config:clear and, if you use queues, php artisan queue:restart.

Microsoft is also retiring basic (password) authentication for SMTP in Exchange Online. If Microsoft 365 rejects a correct password, check Microsoft's current guidance; a transactional email provider or OAuth may be needed.

8. Where Domain India fits

On Domain India shared hosting, PHP mail() with -f works without setup, and support checks the server side for you. For apps that need outside SMTP, a Domain India VPS gives you root access and control of the firewall; VPS plans are self-managed. The App Platform runs apps in containers where SMTP libraries work normally. Compare VPS plans and the App Platform.

Prices on the cards exclude 18% GST.

Ready to get your mail flowing? Read Sending email from PHP for shared hosting, Troubleshooting SMTP relay issues on a VPS for your own server, or open a support ticket with the error you see.