outbound IPv6 tcp/25 blocked outbound

December 31, 2018 1.9k views
IPv6

I've been running a dual-stacked IPv4/IPv6 email server for a while now on DO, which works fine for inbound mail. However, outbound IPv6 connections to tcp/25 are clearly blocked by DO, which is pretty maddening.

The problem is definitely DO. I have specifically allowed IPv6 outbound to tcp/25 via the host-based iptables/ip6tables/ufw firewall, as well as via DO's virtual firewall (managed by me from the DO GUI) applied to the droplet where my mailserver lives.

But DO is blocking IPv6 tcp/25 somewhere else that I cannot configure! You can't even netcat via IPv6 from one DO droplet to another DO droplet on tcp/25.

Yet DO allows tcp/25 outbound via IPv4. That's just messed up and unless there is a solution very soon I will be looking for another hosting company that doesn't treat IPv6 as a second-class protocol.

2 Answers

Hey friend,

We do not allow email traffic over IPv6 as we do not currently support handing out /64s to one customer, and IPv6 RBLs blacklist a full /64 at a time (making it impossible to find the customer responsible for a listing).

In my experience you don't really want outbound email over IPv6 anyway. At best it's a novelty, at worst it's a one-way ticket to the Spam folder. IPv4 is still the gold standard with blanket support across the board, IPv6 is still filtered negatively by the few major email providers that even accept the traffic. Frankly, IPv6 is treated as second-class across the entirety of the internet. As one of the earliest providers to adopt IPv6 we've stood by it's importance, but it doesn't change how the rest of the internet responds to IPv6 traffic, and it's value can only be as great as the adoption and implementations made by the end-points you're communicating with.

Jarland

  • Yes, I do want everything possible using IPv6 -- including email. I am dualstacking IPv4/IPv6 also in order to communicate with laggards.

    Frankly, you must not have used Google or Gmail over the past 5 years if you don't think IPv6 is in wide use. Facebook also has >50% of its US traffic as IPv6. Most cellphones in the US have IPv6. DO needs to get with the times and connect to the whole Internet, not just the legacy one.

    • connect to the whole Internet, not just the legacy one

      If you can share with me some use cases in which you are unable to connect to internet services due to this (where IPv4 will not work), I'd be happy to share this internally.

      • That's the point of this whole thread, that you want to deny. DO droplets cannot connect to IPv6 SMTP. An example is Gmail, smtp.google.com, which works fine from a non-DO host:

        # netcat -6 smtp.gmail.com 25
        220 smtp.gmail.com ESMTP i184sm67373841pfc.41 - gsmtp
        quit
        221 2.0.0 closing connection i184sm67373841pfc.41 - gsmtp
        

        I'm done arguing about this, I'm actively moving my business to a provider who will support IPv6 instead of telling me to turn it off.

That's the point of this whole thread, that you want to deny. DO droplets cannot connect to IPv6 SMTP. An example is Gmail, smtp.google.com, which works fine from a non-DO host:

# netcat -6 smtp.gmail.com 25
220 smtp.gmail.com ESMTP i184sm67373841pfc.41 - gsmtp
quit
221 2.0.0 closing connection i184sm67373841pfc.41 - gsmtp

I'm done arguing about this, I'm actively moving my business to a provider who will support IPv6 instead of telling me to turn it off.

  • No one is denying anything, just wanted to solicit some feedback from someone interested in the topic. Thank you for providing your feedback, and I'm sorry that we couldn't meet your needs on this today.

Have another answer? Share your knowledge.