Debugging SMTP Connection Issues on a cPanel Server with CSF Firewall Enabled

Introduction

Many web hosting providers encounter email delivery issues such as the "Connection timed out (110)" error when attempting to connect to external SMTP servers (e.g., smtp.office365.com:587).

Common Causes:

• System defaults to IPv6, which PHP may mishandle.

• Overly restrictive firewall rules can block outgoing SMTP connections.

• Allowing unrestricted outbound SMTP traffic can lead to spam abuse.

Goals of This Guide

Ensure your server can connect to trusted SMTP providers. Limit outbound SMTP traffic only to those providers via CSF's whitelist. Resolve PHP connectivity issues by forcing IPv4. Adjust application settings (e.g., Laravel's .env) to align with these changes.

Identifying the Problem

Step 1: Testing SMTP Connectivity with nc (netcat)

First, verify that your server can reach the SMTP servers over IPv6 using netcat:

nc -zv smtp.office365.com 587

Success: The server successfully connected to Office365 over IPv6.

Similarly, testing Gmail:

nc -zv smtp.gmail.com 587

Success: Connection to Gmail over IPv6 was also successful.

For SendGrid:

nc -zv smtp-relay.sendgrid.net 587

DNS Resolution Failed: The hostname did not resolve.

Upgraded SMTP Outbound Control

Whitelist Only Trusted SMTP Providers

Instead of completely opening all SMTP traffic or manually removing LOGDROPOUT rules, restrict outbound mail to trusted providers only.

How to Implement:

1 Edit the CSF Allow File:

nano /etc/csf/csf.allow

2 Add the Following Entries:

tcp|out|d=587|d=smtp.office365.com
tcp|out|d=587|d=smtp.gmail.com
tcp|out|d=587|d=smtp-relay.sendgrid.net
tcp|out|d=587|d=smtp.mailgun.org
tcp|out|d=587|d=smtp.zoho.com

3 Restart CSF:

csf -r

Result: Now, only these trusted providers are allowed for sending mail, reducing the risk of spam and abuse from compromised hosted domains.

Continued Testing and Troubleshooting

Step 3: Testing from PHP (test_smtp.php)

Create a simple PHP script to test SMTP connectivity:

<php
$host = "smtp.office365.com";
$port = 587;
$errno = 0;
$errstr = "";

$connection = fsockopen($host, $port, $errno, $errstr, 10);
if (!$connection) {
 echo " Failed to connect: $errstr ($errno)\n";
} else {
 echo " PHP successfully connected to SMTP server!\n";
 fclose($connection);
}
>

Run the script:

php test_smtp.php

Step 4: Checking CSF Firewall Rules

csf -g 587

Look for entries showing your whitelisted providers rather than blanket DROP or LOGDROPOUT rules.

Step 5: Checking If PHP Is Running in a Restricted Environment

Run additional tests (such as using a custom socket connection test) to ensure that PHP isn't subject to further network restrictions beyond CSF.

Step 6: Disabling IPv6 at the System Level

Since the server was defaulting to IPv6 for SMTP connections--which PHP can mishandle--force the system to use IPv4:

sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
sysctl -w net.ipv6.conf.lo.disable_ipv6=1

To make this permanent, add to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Reload the configuration:

sysctl -p

Result: After rebooting, PHP should now default to IPv4.

Step 7: Modifying Laravel .env to Force IPv4 and Disable SSL Verification

For Laravel applications, update your .env file:

MAIL_MAILER=smtp
MAIL_HOST=smtp.office365.com
MAIL_PORT=587
[email protected]
MAIL_PASSWORD=<password>
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="Your App Name"
MAIL_EHLO_DOMAIN=yourdomain.com
MAIL_STREAM_OPTIONS='{"ssl": {"crypto_method": STREAM_CRYPTO_METHOD_TLS_CLIENT, "verify_peer": false, "verify_peer_name": false}}'

Then clear Laravel's caches:

php artisan config:clear
php artisan cache:clear
php artisan queue:restart

Result: Laravel emails should now work correctly.

Conclusion

Root Causes:

• The system defaulted to IPv6 for SMTP connections, while PHP struggled with IPv6 routing.

• Opening outbound SMTP traffic broadly increases the risk of spam abuse.

Final Fixes:

Whitelist Only Trusted SMTP Providers: Outbound SMTP traffic is restricted only to trusted SMTP providers. Disabled IPv6: Forced the server to use IPv4 for better compatibility. Updated Application Configuration: Adjusted Laravel's settings to work with the new network setup.

With these changes, SMTP emails now work reliably on your server while minimizing the risk of spam abuse.