Email alerts fail to send from vCenter Server when SMTP ports 25 or 587 are blocked

Products

• VMware vCenter Server

Issue/Introduction

1. vCenter Server successfully triggers system alarms but fails to send outbound email notifications to the configured SMTP .
2. Alarms appear normally in the vSphere Client UI, but email notifications are not delivered even when manually triggered.
3. Validating the logs on the vCenter server /var/log/vmware/messages:

    ########### VCSA sendmail[2938103]: 65F3tkBG2818773: to=<[email protected]>, delay=01:47:41, xdelay=00:00:00, mailer=relay, pri=391247, relay=[SMTP_IP_ADDRESS], dsn=4.4.1, stat=Deferred: Connection timed out with [SMTP_IP_ADDRESS]
   
    ########### VCSA sendmail[2938103]: 65F3ttC82818919: to=<[email protected]>, delay=01:47:32, xdelay=00:00:00, mailer=relay, pri=391247, relay=[SMTP_IP_ADDRESS], dsn=4.4.1, stat=Deferred: Connection timed out with [SMTP_IP_ADDRESS]

4. Testing connection to SMTP server via curl or telnet on ports 25 or 587 fails .
   Example:

• curl -v telnet://<SMTP_Relay_IP>:25 results in: 421 4.3.2 Service not available
• curl -v smtp://<SMTP_Relay_IP>:587 results in: Failed to connect... Connection timed out

Environment

• VMware vCenter Server 8.0.x
• VMware vCenter Server 7.0.x

Cause

This issue occurs due firewalls preventing traffic on Port 25 and Port 587 between the vCenter Server and the SMTP Relay required for SMTP connections.

Resolution

To resolve these issues, follow the steps below:

• Engage your internal network team to ensure the communication for SMTP traffic on TCP Port 25 and TCP Port 587 from the vCenter Server management IP to the SMTP relay IP is open/active
• Login to the vCenter server via SSH to test the connectivity:

curl -v telnet://<SMTP_Relay_IP>:25 OR curl -v telnet://<SMTP_Relay_IP>:587

• Try sending a Mail using Cli to check if the Mail is getting sent.

echo "Subject: Test" | sendmail -v recipient@####.com

Additional Information

• TCP and UDP ports required to access VMware vCenter Server
• For further details on setting up alarms, see Setting Up Email Notifications for Alarms.
• Make sure the vCenter Server PNID matches the hostname : .vCenter alerts do not get sent - Error "unable to qualify my own domain name (localhost)"
• VCSA inodes getting full due to large files queued for mails /var/spool/clientmqueue
• If you need to speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.