Why can delivery fail when SMTP port 587 works?
Port 587 with STARTTLS lets your website or email application submit a message to your server. For direct delivery, Stalwart resolves the recipient domain’s MX record and connects to the destination on TCP 25. These are separate connections.
If your provider blocks outbound TCP 25, changing your local listener to 587 will not fix delivery. You can configure an authorized SMTP relay on 587 with STARTTLS; the relay completes delivery to the recipient. Mailboxes can remain on your own Stalwart server.
| Connection | Common port | Purpose |
|---|---|---|
| Client → Stalwart | 587 STARTTLS / 465 TLS | Authenticated message submission |
| Stalwart → recipient MX | 25 | Direct transfer between mail servers |
| Stalwart → authorized relay | Provider-defined; often 587 | Outbound delivery through an intermediary |
| Client → mailbox | 993 TLS | Reading mail over IMAP |
Which DNS records does mail need?
MX identifies the incoming mail server; A/AAAA records supply its addresses. SPF describes authorized senders, DKIM publishes a public key for signature verification, and DMARC specifies policy for authentication results and domain alignment.
Reverse DNS (PTR) is controlled by the public IP provider. Creating a forward DNS record in the panel does not change PTR. When adopting a relay, reconcile its SPF and DKIM requirements with existing records; do not publish a second SPF policy for the same name.
Is web SSL the same as the mail certificate?
No. Binding a certificate in IIS does not automatically change the certificate served by Stalwart. The mail service needs the domain mapping, certificate chain and private key applied together.
Review web and mail certificate status separately in AdaPanel. Check the certificate actually served on 587 STARTTLS and 465 TLS for hostname, trust chain and expiry. Disabling validation does not repair a certificate problem.
How do you diagnose a queued message?
- Open the sender, recipient, delivery state and next attempt time.
- Identify whether the destination is the recipient MX or the configured relay.
- For connection timeouts, test the same destination IP and port from the server. Separate DNS, IPv4 and IPv6 results.
- Read SMTP response codes with the command that produced them. A TCP connection failure is not a password, content or spam rejection.
- After the fix, verify one controlled delivery and the received message headers. Deleting the queue does not fix the delivery path.
Frequently asked questions
Does a successful SMTP login prove delivery?
No. Login and acceptance by your submission server are initial steps. Outbound delivery results appear in the queue and the recipient server’s response.
Must I move mailboxes to use an SMTP relay?
No. A relay can handle only outbound delivery while incoming mail and mailboxes remain on your Stalwart server.
Can I replace the recipient MX port with 587 when 25 is blocked?
Standard direct delivery does not work that way. Using 587 requires a server offering submission service and authorizing you to send through it.