Question

outbound IPv6 tcp/25 blocked outbound

  • Posted December 31, 2018
  • IPv6

I’ve been running a dual-stacked IPv4/IPv6 email server for a while now on DO, which works fine for inbound mail. However, outbound IPv6 connections to tcp/25 are clearly blocked by DO, which is pretty maddening.

The problem is definitely DO. I have specifically allowed IPv6 outbound to tcp/25 via the host-based iptables/ip6tables/ufw firewall, as well as via DO’s virtual firewall (managed by me from the DO GUI) applied to the droplet where my mailserver lives.

But DO is blocking IPv6 tcp/25 somewhere else that I cannot configure! You can’t even netcat via IPv6 from one DO droplet to another DO droplet on tcp/25.

Yet DO allows tcp/25 outbound via IPv4. That’s just messed up and unless there is a solution very soon I will be looking for another hosting company that doesn’t treat IPv6 as a second-class protocol.

Subscribe
Share

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

That’s the point of this whole thread, that you want to deny. DO droplets cannot connect to IPv6 SMTP. An example is Gmail, smtp.google.com, which works fine from a non-DO host:

# netcat -6 smtp.gmail.com 25
220 smtp.gmail.com ESMTP i184sm67373841pfc.41 - gsmtp
quit
221 2.0.0 closing connection i184sm67373841pfc.41 - gsmtp

I’m done arguing about this, I’m actively moving my business to a provider who will support IPv6 instead of telling me to turn it off.

Hey friend,

We do not allow email traffic over IPv6 as we do not currently support handing out /64s to one customer, and IPv6 RBLs blacklist a full /64 at a time (making it impossible to find the customer responsible for a listing).

In my experience you don’t really want outbound email over IPv6 anyway. At best it’s a novelty, at worst it’s a one-way ticket to the Spam folder. IPv4 is still the gold standard with blanket support across the board, IPv6 is still filtered negatively by the few major email providers that even accept the traffic. Frankly, IPv6 is treated as second-class across the entirety of the internet. As one of the earliest providers to adopt IPv6 we’ve stood by it’s importance, but it doesn’t change how the rest of the internet responds to IPv6 traffic, and it’s value can only be as great as the adoption and implementations made by the end-points you’re communicating with.

Jarland