Recent changes to support-requests

#134 How to only allow connections from approved/trusted real world IPs

2026-03-18T10:19:25.724000Z

Doh! That's why I could not get it to work! Thanks - now works fine. Great SMTP server.

#134 How to only allow connections from approved/trusted real world IPs

2026-03-17T18:53:44.649000Z

(I shouldn't post code off the top of my head -- in the original version the dots in the address would match any character in the address, not just a literal dot. I've changed it to use an exact match.)

To allow a handful of addresses you could just extend the "test" expression with "-o":

if test "$ip" = "10.0.0.1" -o "$ip" = "192.168.1.1" -o ...etc...

or iterate through a list:

whitelist="10.0.0.1 192.168.1.1"
for w in $whitelist; do test "$ip" = "$w" && allow=y; done
if test "$allow" = "y"
then
..etc..

#134 How to only allow connections from approved/trusted real world IPs

2026-03-17T17:27:48.151000Z

Thanks - good pointers - much appreciated. Is whitelist comma separated or something else? (CDIR perhaps?)

#134 How to only allow connections from approved/trusted real world IPs

2026-03-17T16:35:43.845000Z

Since you asked about using the address-verifier to authorise the IP address I was going to suggest a script like this (or equivalent in JScript):

#!/bin/sh
whitelist="10.0.0.1"
if echo "$3" | grep -q "^$whitelist:"
then
    echo ""
    echo "$1"
    exit 1
else
    exit 100
fi

Unfortunately the connection-abort feature is broken in v2.6.x -- the protocol stops but the connection persists. The alternative is to reject all recipient addresses with an error message. The remote client cannot then submit the e-mail because it has no recipients:

#!/bin/sh
whitelist="10.0.0.1"
if echo "$3" | grep -q "^$whitelist:"
then
    echo ""
    echo "$1"
    exit 1
else
    echo unauthorised IP address: $3
    exit 2
fi

#134 How to only allow connections from approved/trusted real world IPs

2026-03-17T14:51:29.585000Z

FWIW...
In our dev set up I have set up plain text authentication which works for us as we only have one real world box connecting to our site.

So connections which are not authnticated fail like this:

emailrelay: 20260317.144321.786: info: 18.209.86.113;4843: smtp connection from 18.209.86.113:4843
emailrelay: 20260317.144322.385: info: dnsbl: address [18.209.86.113] allowed by [spam.dnsbl.example.com]
emailrelay: 20260317.144322.385: info: dnsbl: address [18.209.86.113] allowed by [block.dnsbl.example.com]
emailrelay: 20260317.144322.385: info: tx>>: "220 smtp2.lymden-lodge.net -- E-MailRelay V2.6.1 -- Service ready"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: rx<<: "EHLO keeper-us-east-1d.mxtoolbox.com"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: tx>>: "250-smtp2.lxxxxxxt says hello"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: tx>>: "250-AUTH CRAM-SHA512 CRAM-SHA256 CRAM-SHA1 CRAM-MD5 PLAIN LOGIN"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: tx>>: "250-VRFY"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: tx>>: "250-PIPELINING"
emailrelay: 20260317.144323.240: info: 18.209.86.113;4843: tx>>: "250 8BITMIME"
emailrelay: 20260317.144323.881: info: 18.209.86.113;4843: rx<<: "MAIL FROM:supertool@mxtoolboxsmtpdiag.com"
emailrelay: 20260317.144323.881: info: 18.209.86.113;4843: server authentication enabled but not a trusted address: 18.209.86.113
emailrelay: 20260317.144323.881: info: 18.209.86.113;4843: tx>>: "530 authentication required"
emailrelay: 20260317.144324.360: info: 18.209.86.113;4843: rx<<: "RCPT TO:test@mxtoolboxsmtpdiag.com"
emailrelay: 20260317.144324.360: info: 18.209.86.113;4843: tx>>: "503 command out of sequence -- use RSET to resynchronise"
emailrelay: 20260317.144324.584: info: 18.209.86.113;4843: rx<<: "QUIT"
emailrelay: 20260317.144324.584: info: 18.209.86.113;4843: tx>>: "221 OK"
emailrelay: 20260317.144324.584: info: 18.209.86.113;4843: smtp connection closed: smtp protocol done: 18.209.86.113:4843
emailrelay: 20260317.144324.584: info: forwarding: [client disconnect]
emailrelay: 20260317.144324.585: info: forwarding: no messages to send

and an authenticated msg gets through...

Connecting to mail server.
Connected.
220 smtpxxxxxt -- E-MailRelay V2.6.1 -- Service ready
EHLO WM-PC01
250-xxxxxxx says hello
250-AUTH CRAM-SHA512 CRAM-SHA256 CRAM-SHA1 CRAM-MD5 PLAIN LOGIN
250-VRFY
250-PIPELINING
250 8BITMIME
AUTH LOGIN
334 VXNlcm5hbW6=
dGFsa2luZQ=
334 UGFzc3dvcm=6
M21t
235 authentication successful
RSET
250 state reset
MAIL FROM: admin@company.net
250 sender admin@company.net OK
RCPT TO: admin@company.net
250 recipient admin@company.net OK
DATA
354 start mail input -- end with <crlf>.<crlf>
.
250 message processed
Forcing disconnection from SMTP server.
QUIT
221 OK
Disconnected.</crlf></crlf>

Message Sent Successfully

and, no, the auth data is not the real stuff!

#132 Allow specific remote clients

2026-03-16T20:19:00.311000Z

I'll respond on your ticket https://sourceforge.net/p/emailrelay/support-requests/134

#132 Allow specific remote clients

2026-03-16T19:48:40.920000Z

Can you expand on this a bit please - possibly with more details on the address verifier..? Thanks.

How to only allow connections from approved/trusted real world IPs

2026-03-16T19:46:51.299000Z

HI
I'm sure I should be able to set this up (Windows server 2025) but I want to only allow connections from a single trusted real world IP to the SMTP instance which then forwards the traffic to another SMTP server for distribution.

All suggestions much appreciated! Thanks.

#133 APPCRASH

2026-03-13T16:23:42.219000Z

Thanks for the extra information. There is nothing unusual in that log snippet or command-line and it does agree with the suggestion that the fault was while instantiating the client secret. I have reviewed the code and re-run unit tests, but I can't see anything suspicious. I note that the log is not showing the secrets file being re-read at that time ("re-reading secrets file"), but that might be one thing to keep an eye on.

For future releases I will add the map file to the output from the GitHub Actions build.

#133 APPCRASH

2026-03-12T10:35:02.880000Z

emailrelay: 20260307.112801.264: info: smtp connection from <IP1>
emailrelay: 20260307.112801.264: info: tx>>: "220 <domainname> -- E-MailRelay V2.4.1 -- Service ready"
emailrelay: 20260307.112801.264: info: rx<<: "EHLO <hostname>"
emailrelay: 20260307.112801.264: info: tx>>: "<domainname> says hello\r\n250-AUTH CRAM-MD5 CRAM-SHA1 CRAM-SHA256 PLAIN LOGIN\r\n250-STARTTLS\r\n250-VRFY\r\n250 8BITMIME"
emailrelay: 20260307.112801.265: info: rx<<: "AUTH login  [not logged]"
emailrelay: 20260307.112801.265: info: tx>>: "334 UGFzc3dvcmQ6"
emailrelay: 20260307.112801.265: info: rx<<: "[authentication response not logged]"
emailrelay: 20260307.112801.265: info: successful authentication of remote client using mechanism [login] and plaintext secret for [<username>] from line 1
emailrelay: 20260307.112801.265: info: tx>>: "235 authentication successful"
emailrelay: 20260307.112801.265: info: rx<<: "MAIL FROM:<sender>"
emailrelay: 20260307.112801.265: info: content file: C:\ProgramData\E-MailRelay\spool\emailrelay.10172.1772879281.922.content
emailrelay: 20260307.112801.266: info: tx>>: "250 OK"
emailrelay: 20260307.112801.266: info: rx<<: "RCPT TO:<recipient>"
emailrelay: 20260307.112801.266: info: tx>>: "250 OK"
emailrelay: 20260307.112801.266: info: rx<<: "DATA"
emailrelay: 20260307.112801.266: info: tx>>: "354 start mail input -- end with <CRLF>.<CRLF>"
emailrelay: 20260307.112801.268: info: rx<<: [message content not logged]
emailrelay: 20260307.112801.268: info: rx<<: "."
emailrelay: 20260307.112801.268: info: envelope file: emailrelay.10172.1772879281.922.envelope.new
emailrelay: 20260307.112801.269: info: tx>>: "250 OK"
emailrelay: 20260307.112803.155: info: smtp connection closed: network event: connection aborted: <IP1>
emailrelay: 20260307.112803.155: info: forwarding: [client disconnect]

This is the last connection that the relay logged(edited to make it anonymous).
I can also confirm that the faulting module is indeed shown as "C:\Program Files (x86)\E-MailRelay\emailrelay.exe".

The configuration was as followed:

start "emailrelay" "C:\Program Files (x86)\E-MailRelay\emailrelay.exe" --poll 3600 --client-tls --close-stderr --forward-on-disconnect --forward-to smtp.office365.com:587 --log --log-file C:\ProgramData\E-MailRelay\log\emailrelay-log-%%d.txt --log-time --pid-file C:\ProgramData\E-MailRelay\emailrelay.pid --remote-clients --client-auth C:\ProgramData\E-MailRelay\auth\emailrelay.auth --server-auth C:\ProgramData\E-MailRelay\auth\emailrelay.auth --spool-dir C:\ProgramData\E-MailRelay\spool --server-tls --server-tls-certificate "C:\ProgramData\E-MailRelay\certs\key.pem" --server-tls-certificate "C:\ProgramData\E-MailRelay\certs\cert.pem" --verbose

The relay had been running for roundabout 4 days straight, and had been running for longer periods before without any issues. The appcrash has, to my knowledge, never happend before.

We have scince updated to version 2.6.1 (regardless of this crash) and hope that this crash doesnt happen again, however if your still able to uncover what caused this crash that would be deeply appreciated.

Kind regards