# Router SMTP Troubleshooting Reference

Tested against `mail.germainebrown.com` (MXroute, port 2525) from a CCR2004-16G-2S+ (RouterOS 7.18.2) behind AT&T residential fiber via a netcup KVM.

## Validated Working Config

```
/tool/e-mail/set server=mail.germainebrown.com port=2525 tls=starttls \
  from="g@germainebrown.com" password="<correct-password>"
/ip/dns/set servers=10.1.1.14,10.1.1.10
/ip/firewall/filter/add chain=input action=accept connection-state=established,related \
  place-before=1 comment="Allow established/related input"
```

## Error Diagnosis Table

| Log Error (`/log/print where topics~"e-mail"`) | Root Cause | Fix |
|---|---|---|
| `DNS resolve failed` | Router DNS empty or AT&T DHCP (192.168.1.254) can't resolve mail.germainebrown.com | `/ip/dns/set servers=<internal-dns>` |
| `timeout occured` | Missing established/related INPUT rule — SMTP connects but return packets are dropped by WAN-DROP | Add input established/related rule (see above) |
| `AUTH failed` | Wrong SMTP password | `/tool/e-mail/set password="<correct>"` |
| `succeeded` | Working | Nothing |

## The established/related INPUT Rule

The router HAS an established/related rule on the **forward** chain (line 13), but unless explicitly added, the **INPUT** chain may lack one. Without it, any connection initiated BY the router (SMTP, DNS, API calls) has its response packets dropped by the WAN-DROP rule on the INPUT chain.

**Symptom:** DNS resolved fine, port was correct, AUTH didn't fail — just `timeout occured`. The router's outbound SYN reached the server, the server responded with SYN-ACK, but WAN-DROP on INPUT killed the response before the SMTP process saw it.

**Fix location:** Rule must be `chain=input` with `place-before=1` so it sits before WAN-DROP. NOT on the forward chain.

## Port Restrictions from netcup KVM

Only port **2525** works for outbound SMTP from this netcup box. Ports 25, 465, 587 all timeout. This is a netcup infrastructure restriction, not a router issue.

- TLS mode for port 2525: **starttls** (not `yes`/SSL)
- TLS mode for port 465: **yes** (SSL/TLS direct)

## DNS Resolution Path

The router's `dynamic-servers` comes from AT&T DHCP (192.168.1.254). AT&T's DNS cannot resolve `mail.germainebrown.com`. The static `servers` override must point to internal DNS (AdGuard at 10.1.1.14, 10.1.1.10).

## Verification Command

```
/tool/e-mail/print
```

Look for `last-status: succeeded`. If `failed`, check `/log/print where topics~"e-mail"` for the specific error and cross-reference the table above.

## Historical Context (Jul 9, 2026)

During the core migration, the home router's SMTP had been broken for months (run-count=0 on all schedulers). The port was still set to 465 (from Hetzner days where port 465 worked). The DNS was using AT&T's DHCP servers. The INPUT chain had no established/related rule. Fixing all three in sequence produced the error progression:
- DNS fix → `timeout occured` (was DNS resolve failed before)
- INPUT rule fix → `AUTH failed` (was timeout before)  
- Password update → `succeeded`

## Router Scheduler SMTP (Email - Router Logs / Config / Backup)

Three schedulers on the home router send daily email backups at 4:00 AM. They had `run-count=0` which means they had never successfully executed. When investigating broken schedulers:

1. **Check SMTP first** — `/tool/e-mail/print` shows last-status. If failed, check `/log/print where topics~"e-mail"`
2. **File name mismatch** — Scheduler uses `file=home-rtr-logs.txt` but `/log print file=logs` creates `logs.txt`, not `home-rtr-logs.txt`. The file created and the file attached by the scheduler MUST match exactly. Fix by making `/log print file=home-rtr-logs` create the correct base name, then attach `.txt`.
3. **RouterOS 7.18.2 file naming quirks:**
   - `/log print file=<name>` creates `<name>.txt`
   - `/export file=<name>` creates `<name>.rsc` (auto-appends .rsc)
   - `/system backup save name=<name>` creates `<name>.backup`
   - The scheduler's `file=<name>` must include the correct extension

**Fix pattern for scheduler scripts:**

```
# Logs — file base name must match across creation and send
/system/scheduler/set [find where name="Email - Router Logs"] \
  on-event="/log print file=home-rtr-logs\n:\delay 10\n/tool e-mail send \
    to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-logs.txt"

# Config — export auto-appends .rsc
/system/scheduler/set [find where name="Email - Router config (RCS)"] \
  on-event="/export file=home-rtr-config\n/tool e-mail send \
    to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-config.rsc"
```