fiza Posted March 28, 2023 Posted March 28, 2023 I am trying to set up File Server Resource Manager so it sends email notifications via Gmail. I have used smtp-relay.gmail.com which works for us in other areas but for some reason FSRM refuses to send emails. In the application logs I get A File Server Resource Manager Service email action could not be run. Error-specific details: Error: IFsrmEmailExternal::SendMail, 0x8004531c, Failure sending mail.: Unable to connect to the remote server Has anyone set up FSRM with Gmail smtp relay?
timbo343 Posted March 28, 2023 Posted March 28, 2023 I got it working as a test and here are my notes: It didn't work at first but reading some of the articles online for Google Mail and muddling through Google's crappy settings, I had to configure a relay option in our Google Workspace for our External IP addresses. I tested an existing account on our Google domain and set "less secure apps" to on which means there is no authentication required as FRSM does not have the ability to set any authentication credentials and this account has no 2FA enabled on it either. We use specific mailboxes for each service notification if that makes sense. For example, Papercut has a Papercut email account which has 2FA enabled on it but Google requires us to set "App passwords" for this account which bypass 2FA so they can be used as service accounts - this only works if there is authentication required on the mailbox.
RLR Posted March 28, 2023 Posted March 28, 2023 I got it working as a test and here are my notes: It didn't work at first but reading some of the articles online for Google Mail and muddling through Google's crappy settings, I had to configure a relay option in our Google Workspace for our External IP addresses. This is what we've done. Setup our public IP to allow it to send the emails.
jthompson Posted March 28, 2023 Posted March 28, 2023 Regarding the 'Less secure apps' option, don't enable that. Just set up the sending account with some 2FA and then in the account settings create an app-specific password. FSRM would then use that app-specific password to authenticate with the Gmail SMTP relay service. The 'Less secure apps' option might be deprecated now anyway.
fiza Posted March 28, 2023 Author Posted March 28, 2023 I got it working as a test and here are my notes: It didn't work at first but reading some of the articles online for Google Mail and muddling through Google's crappy settings, I had to configure a relay option in our Google Workspace for our External IP addresses. I tested an existing account on our Google domain and set "less secure apps" to on which means there is no authentication required as FRSM does not have the ability to set any authentication credentials and this account has no 2FA enabled on it either. We use specific mailboxes for each service notification if that makes sense. For example, Papercut has a Papercut email account which has 2FA enabled on it but Google requires us to set "App passwords" for this account which bypass 2FA so they can be used as service accounts - this only works if there is authentication required on the mailbox. I was under the impression that using the gmail smtp relay allowed us to send emails without authentication and avoid the use of less secure apps and App passwords? This is what we've done. Setup our public IP to allow it to send the emails. We already have our Public IP set in Google as this is how Papercut sends emails so I don't see why FSRM emails are not working for us.
jthompson Posted March 28, 2023 Posted March 28, 2023 Is option 1 on your Gmail SMTP Relay Service set to "Only adresses in my domains". I'm assuming that your FSRM "From" address is also set to use an address in your domain. Beyond that, could option 3 (TLS) be playing a part? We direct our FSRM at an on-prem postfix server, which itself then authenticates with a Gmail SMTP Relay Service.
fiza Posted March 28, 2023 Author Posted March 28, 2023 Is option 1 on your Gmail SMTP Relay Service set to "Only adresses in my domains". I'm assuming that your FSRM "From" address is also set to use an address in your domain. Beyond that, could option 3 (TLS) be playing a part? We direct our FSRM at an on-prem postfix server, which itself then authenticates with a Gmail SMTP Relay Service. Option 1 is set to "Only addresses in my domains" FSRM From address is also an address in the domain. Option 3 is unticked.
RLR Posted March 28, 2023 Posted March 28, 2023 (edited) I was under the impression that using the gmail smtp relay allowed us to send emails without authentication and avoid the use of less secure apps and App passwords? We already have our Public IP set in Google as this is how Papercut sends emails so I don't see why FSRM emails are not working for us. Is the email address you're using as the FROM address an actual account in your Google tenant? I've had it in the past where the Comprehensive mail storage option in the Google Admin console stops SMTP working as it requires authentication to make sure all email is stored in the associated user' mailboxes. Edited March 28, 2023 by RLR
fiza Posted March 28, 2023 Author Posted March 28, 2023 Is the email address you're using as the FROM address an actual account in your Google tenant? I've had it in the past where the Comprehensive mail storage option in the Google Admin console stops SMTP working as it requires authentication to make sure all email is stored in the associated user' mailboxes. It is an actual account in our Google tenant.
RLR Posted March 28, 2023 Posted March 28, 2023 It is an actual account in our Google tenant. Have you checked if Comprehensive Mail Storage is turned on for the OU this account resides in? If it is turned on, try turning it off. Might want to move the account to it's own OU if you want this setting on for other accounts. Admin console > Apps > Google Workspace > Gmail > Compliance > Drill down to ou the account lives in > Check Comprehensive mail storage option Another thing to check is firewall ports?
fiza Posted March 28, 2023 Author Posted March 28, 2023 Have you checked if Comprehensive Mail Storage is turned on for the OU this account resides in? If it is turned on, try turning it off. Might want to move the account to it's own OU if you want this setting on for other accounts. Admin console > Apps > Google Workspace > Gmail > Compliance > Drill down to ou the account lives in > Check Comprehensive mail storage option Another thing to check is firewall ports? I have moved the account to a new OU that does not have comprehensive mail storage enabled but the same issue arises. What firewall ports would I need to look at? Is this on the server firewall or the perimeter firewall?
RLR Posted March 28, 2023 Posted March 28, 2023 I have moved the account to a new OU that does not have comprehensive mail storage enabled but the same issue arises. What firewall ports would I need to look at? Is this on the server firewall or the perimeter firewall? Usual ports for SMTP are 25, 465 and 587. 465 and 587 are secure ports so I'd imagine just opening 25 would be fine. Something else to try is setting the from address to a domain email that isn't an actual account. You should be able to set anything as the from address if you have your public IP listed as allowed to send emails.
fiza Posted November 14, 2023 Author Posted November 14, 2023 @fiza did you ever get this working? As per my input on your thread, I did not. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now