Router SMTP Troubleshooting Reference

Tested against mail.germainebrown.com (MXroute, port 2525) from a CCR2004-16G-2S+ (RouterOS 7.18.2) behind AT&T residential fiber via a netcup KVM.

Validated Working Config

/tool/e-mail/set server=mail.germainebrown.com port=2525 tls=starttls \
  from="g@germainebrown.com" password="<correct-password>"
/ip/dns/set servers=10.1.1.14,10.1.1.10
/ip/firewall/filter/add chain=input action=accept connection-state=established,related \
  place-before=1 comment="Allow established/related input"

Error Diagnosis Table

Log Error (`/log/print where topics~"e-mail"`)	Root Cause	Fix
`DNS resolve failed`	Router DNS empty or AT&T DHCP (192.168.1.254) can't resolve mail.germainebrown.com	`/ip/dns/set servers=<internal-dns>`
`timeout occured`	Missing established/related INPUT rule — SMTP connects but return packets are dropped by WAN-DROP	Add input established/related rule (see above)
`AUTH failed`	Wrong SMTP password	`/tool/e-mail/set password="<correct>"`
`succeeded`	Working	Nothing

The established/related INPUT Rule

The router HAS an established/related rule on the forward chain (line 13), but unless explicitly added, the INPUT chain may lack one. Without it, any connection initiated BY the router (SMTP, DNS, API calls) has its response packets dropped by the WAN-DROP rule on the INPUT chain.

Symptom: DNS resolved fine, port was correct, AUTH didn't fail — just timeout occured. The router's outbound SYN reached the server, the server responded with SYN-ACK, but WAN-DROP on INPUT killed the response before the SMTP process saw it.

Fix location: Rule must be chain=input with place-before=1 so it sits before WAN-DROP. NOT on the forward chain.

Port Restrictions from netcup KVM

Only port 2525 works for outbound SMTP from this netcup box. Ports 25, 465, 587 all timeout. This is a netcup infrastructure restriction, not a router issue.

TLS mode for port 2525: starttls (not yes/SSL)
TLS mode for port 465: yes (SSL/TLS direct)

DNS Resolution Path

The router's dynamic-servers comes from AT&T DHCP (192.168.1.254). AT&T's DNS cannot resolve mail.germainebrown.com. The static servers override must point to internal DNS (AdGuard at 10.1.1.14, 10.1.1.10).

Verification Command

/tool/e-mail/print

Look for last-status: succeeded. If failed, check /log/print where topics~"e-mail" for the specific error and cross-reference the table above.

Historical Context (Jul 9, 2026)

During the core migration, the home router's SMTP had been broken for months (run-count=0 on all schedulers). The port was still set to 465 (from Hetzner days where port 465 worked). The DNS was using AT&T's DHCP servers. The INPUT chain had no established/related rule. Fixing all three in sequence produced the error progression:

DNS fix → timeout occured (was DNS resolve failed before)
INPUT rule fix → AUTH failed (was timeout before)
Password update → succeeded

Router Scheduler SMTP (Email - Router Logs / Config / Backup)

Three schedulers on the home router send daily email backups at 4:00 AM. They had run-count=0 which means they had never successfully executed. When investigating broken schedulers:

Check SMTP first — /tool/e-mail/print shows last-status. If failed, check /log/print where topics~"e-mail"
File name mismatch — Scheduler uses file=home-rtr-logs.txt but /log print file=logs creates logs.txt, not home-rtr-logs.txt. The file created and the file attached by the scheduler MUST match exactly. Fix by making /log print file=home-rtr-logs create the correct base name, then attach .txt.
RouterOS 7.18.2 file naming quirks:
- /log print file=<name> creates <name>.txt
- /export file=<name> creates <name>.rsc (auto-appends .rsc)
- /system backup save name=<name> creates <name>.backup
- The scheduler's file=<name> must include the correct extension

Fix pattern for scheduler scripts:

# Logs — file base name must match across creation and send
/system/scheduler/set [find where name="Email - Router Logs"] \
  on-event="/log print file=home-rtr-logs\n:\delay 10\n/tool e-mail send \
    to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-logs.txt"

# Config — export auto-appends .rsc
/system/scheduler/set [find where name="Email - Router config (RCS)"] \
  on-event="/export file=home-rtr-config\n/tool e-mail send \
    to=\"g@germainebrown.com\" subject=\"...\" body=\"...\" file=home-rtr-config.rsc"

4.5 KiB Raw Blame History