When Sendmail appears to be running but messages never arrive, start with evidence rather than restarting it repeatedly. A successful local submission only proves that the message entered the local mail system. The decisive clues are the listening socket, Sendmail’s mail log, the queue’s delivery status, DNS and hostname qualification, relay policy, and whether the VPS network permits outbound TCP port 25.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Work through those checks in order. They separate a local daemon or configuration fault from a provider block, recipient-side rejection, TLS failure, or an intentional “relaying denied” policy. Fix only the failing layer; never enable unrestricted relay as a shortcut.
As an Amazon Associate I earn from qualifying purchases.
What “Sendmail is not working” can mean
Several different failures look identical from a mail client:
- The service is stopped, starts with errors, or is running under a distribution-specific unit name.
- The daemon is running but is not listening on the interface and port you expect. Red Hat documents cases in which Sendmail runs without listening on port 25, or listens on port 587 instead.
- A message is accepted locally and placed in the queue, but delivery is deferred because DNS, routing, TLS, recipient policy, or port 25 connectivity failed.
- The server rejects a client with a 550-style “relaying denied” response. Sendmail 8.9 and later deny relaying by default.
- Address rewriting cannot qualify the local hostname, producing an invalid or incomplete sender identity.
- TCP connects successfully, but STARTTLS negotiation or authentication fails afterward.
These are different repairs. Begin by identifying which state you actually have.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
1. Confirm the package, service, and version
Do not assume every Linux distribution uses the same service unit or package layout. Identify the installed Sendmail package, the service unit used by that distribution, and the version before changing configuration.
Check service state and recent startup errors
- Run the distribution’s service-status command for its Sendmail unit, such as the unit exposed by
systemctl. Ifsendmail.serviceis not present, list or inspect the unit name supplied by the package instead of creating a new one. - Read the recent journal entries for that unit. Look for configuration parse errors, permission failures, hostname-qualification warnings, and bind errors.
- Record the Sendmail version. Configuration syntax, generated files, and available diagnostics can differ between releases.
A service marked “active (running)” is only a process-status result. It does not prove that SMTP is reachable, that the daemon is listening on the intended port, or that queued messages can leave the VPS.
Check the effective configuration files
Sendmail commonly uses a source configuration such as /etc/mail/sendmail.mc and a generated sendmail.cf. Inspect both, and pay particular attention to DAEMON_OPTIONS. A change in the source file has no effect until the distribution’s normal generation step creates the effective configuration and the daemon reloads it.
2. Verify the listening socket
Run a listener check from the VPS:
sudo ss -ltnp | grep -E ':(25|465|587)b'Compare every result with the ports and addresses configured in sendmail.mc and the generated sendmail.cf.
Interpret the address and port
- No matching line: Sendmail is not listening on any of those ports. Check startup errors, generated configuration, and whether the daemon actually reloaded.
- Only
127.0.0.1(or another loopback address): Local applications can submit mail, but remote SMTP clients cannot connect. A listener bound only to loopback cannot accept connections from the network. - Port 587 instead of 25: The daemon may be configured for submission rather than direct-to-recipient SMTP. Test the port your clients and architecture are meant to use.
- An unexpected interface: A specific bind address can exclude the VPS’s public or private interface. Correct the relevant
DAEMON_OPTIONSentry rather than opening every interface blindly.
Port 25 is Sendmail’s default SMTP port in the Fedora administration guidance. Ports 465 and 587 can be present for encrypted or authenticated submission, but their presence does not prove that direct delivery on port 25 works.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Read the mail log while reproducing one test
Sendmail writes through syslog’s LOG_MAIL facility. Depending on the distribution, records commonly appear in /var/log/maillog, /var/log/mail.log, or /var/log/syslog.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo tail -F /var/log/maillog /var/log/mail.log /var/log/syslogUse the file that exists on your VPS; the command above is a convenient way to follow several possible paths, but a missing path may produce an error on some systems. Start the tail, submit one controlled message, and follow that message’s records instead of generating many tests at once.
Fields that identify the failure
relay=identifies the host Sendmail attempted to contact or the relay that accepted the message.dsn=records the delivery-status notification code.stat=describes the current result, such as successful delivery, deferral, or failure.status=, when present in the system’s mail-log format, provides another delivery result indicator.- Connection timeouts and refusals point toward routing, firewall, or provider policy.
- DNS lookup failures point toward resolver, MX, forward-DNS, or hostname problems.
- Authentication, certificate, and STARTTLS errors belong to the TLS or relay stage, not to listener troubleshooting.
- A 550-style relay response indicates policy, client identity, recipient class, or access-map evaluation.
Sendmail’s operations guidance distinguishes receipt records from delivery-attempt records. One message can therefore have an accepted local record followed by several delivery attempts when delivery is deferred. Do not label a queued message as delivered merely because the first log line says it was accepted.
4. Separate local submission from remote delivery
Run a controlled local submission and then inspect its log records. The result divides the investigation:
- Local submission fails immediately: investigate file permissions, aliases, configuration syntax, hostname qualification, and the local daemon.
- Local submission succeeds and the message is delivered: Sendmail is functioning for that path; investigate the application or client that generated the original message.
- Local submission succeeds but delivery is deferred: investigate recipient MX resolution, outbound port 25, DNS identity, TLS, and remote policy.
- Local submission is rejected with “relaying denied”: inspect the connecting identity, local-domain classification, relay classes, and the access database before changing anything.
Use non-delivery diagnostics first
These commands test Sendmail’s interpretation without sending a real message:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sendmail -bv [email protected]
sendmail -btsendmail -bv verifies names without collecting or delivering a message. sendmail -bt enters address-test mode so you can debug rewriting and configuration rules. Use the exact address that fails, and preserve the output alongside the corresponding mail-log entry.
5. Verify hostname and DNS qualification
Outbound SMTP identity depends on a stable, fully qualified hostname and working DNS. Before editing rewrite rules, verify the effective hostname and resolver results from the VPS.
Checks to perform
- Confirm that the system reports a stable fully qualified hostname rather than a short name or an automatically assigned temporary name.
- Confirm forward DNS for that hostname and for the sending domain used in the envelope or header.
- Where the network and address allocation support it, confirm reverse DNS (PTR) for the VPS’s public address.
- Resolve the recipient domain’s MX records from the VPS and check that the returned hosts are reachable.
- Compare the hostname that Sendmail uses in logs and SMTP greetings with the name configured for the VPS and domain.
Sendmail documentation and Red Hat troubleshooting examples show that an unqualified local hostname can delay startup or produce malformed outbound identity. Correct the system hostname and DNS delegation first; changing rewrite rules cannot compensate for a name that the operating system and resolver cannot establish.
6. Fix “relaying denied” without creating an open relay
Sendmail 8.9 and later deny relaying by default. That default protects the VPS from being abused to send other people’s mail. A 550 relay error is therefore not evidence that Sendmail is broken; it means the request did not match an allowed local or relay path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Read the exact rejected request
Use the log line to identify the connecting IP address, the envelope sender, and the recipient domain or class. Then determine whether the sender is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- a local application submitting through the loopback interface;
- a trusted internal host that should be listed explicitly;
- a recipient in a domain the server is configured to handle locally; or
- an external destination that requires an authenticated relay.
Do not infer the cause from the client error alone. The same 550 response can result from an unrecognized client address, a domain missing from local classifications, or an access-map rule that denies the request.
Test rules and access-map lookups
The Sendmail debugging guidance recommends sendmail -bt checks for check_rcpt and check_relay, together with lookups in the access map. Test the actual client identity and recipient used in the failing transaction.
If the configuration uses /etc/mail/access, edit only the narrowly required host, user, or domain entries. Rebuild its database with the distribution’s documented makemap command, then reload or restart Sendmail using the normal service procedure. A source-file edit without rebuilding the map leaves the running daemon using the old rules.
Permit only identities that genuinely need relay access. Never resolve a relay error by enabling unrestricted relay for all clients or all domains; that converts a client-configuration problem into an abuse and reputation problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Test outbound port 25 and VPS-provider policy
Direct delivery requires the VPS to resolve recipient MX records and establish outbound TCP connections to their SMTP servers, normally on port 25. A timeout or refusal at that stage indicates a network, firewall, or provider-path problem, not necessarily a Sendmail syntax error.
Distinguish local and upstream blocks
- Check the VPS host firewall and any cloud security-group or egress rule that controls outbound TCP 25.
- Resolve a real recipient domain’s MX records from the VPS.
- Test TCP reachability to one of those MX hosts on port 25, recording whether the result is an immediate refusal or a timeout.
- Compare the connectivity result with the Sendmail log’s
relay=,dsn=, andstat=fields.
An immediate refusal can come from the destination or an intermediate policy device. A timeout is consistent with filtering or a broken route. In both cases, confirm the VPS provider’s outbound-mail policy; some providers block port 25 for new or unverified instances.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose direct delivery or an authenticated relay
| Decision factor | Direct-to-recipient delivery | Authenticated SMTP relay |
|---|---|---|
| Outbound port | Requires working outbound TCP port 25 to recipient MX hosts. | Uses the relay service’s supported submission port when direct port 25 is blocked or unreliable. |
| Authentication | Sendmail presents the server and domain identity; no upstream submission account is involved. | Requires valid relay credentials and compliance with the relay’s sender policy. |
| TLS | Negotiation occurs with each recipient that offers or requires it. | TLS and authentication are negotiated with the selected relay and must be tested together. |
| DNS and reverse DNS | Stable hostname, forward DNS, and applicable reverse DNS strongly affect acceptance and reputation. | The relay supplies the outbound delivery path, but your sender identity and domain policy still need to be valid. |
| Queue and retries | Sendmail handles recipient connections and retries directly; each destination’s response appears in your logs. | Sendmail queues to one upstream endpoint, which then handles final recipient delivery; your logs show acceptance or rejection by that relay. |
| Provider policy | Works only when the VPS network permits direct SMTP and recipient systems accept the VPS identity. | Appropriate when the VPS provider blocks port 25 or direct delivery is operationally unreliable. |
Choose direct delivery only when the network path, DNS identity, and domain reputation support it. If the provider blocks direct SMTP, configure an authenticated submission relay on the provider’s supported port and verify credentials, TLS requirements, sender policy, and the relay’s acceptance response. Treat this as an architecture change, not as a local Sendmail restart.
8. Test STARTTLS independently
A successful TCP connection proves only that the socket is reachable. It does not prove that STARTTLS negotiation, certificate loading, or authentication will succeed.
Inspect the SMTP capability exchange
- Connect to the local SMTP listener or the configured relay endpoint using the path that is failing.
- Inspect the server’s advertised capabilities and verify that
STARTTLSappears when encryption is required. - Attempt the TLS negotiation and record the exact failure stage.
- Review Sendmail’s mail log for certificate errors, unreadable key or certificate files, unsafe-file warnings, and authentication failures.
Keep listener, relay-policy, and TLS tests separate. A missing STARTTLS capability is different from a certificate permission error, and both are different from a 550 relay denial. Fix the first failing protocol stage, then repeat the same controlled test.
9. A symptom-to-action checklist
| Observed result | Most useful next check | What a successful check establishes |
|---|---|---|
| Service is active, but no port 25 listener appears | Inspect DAEMON_OPTIONS, generated sendmail.cf, and startup journal entries |
Whether the daemon is configured and able to bind the intended socket |
| Listener is only on loopback | Compare bind addresses with the required client path | Whether remote clients can reach the SMTP service |
| Local submission is rejected | Run sendmail -bv and sendmail -bt; inspect permissions, aliases, and syntax errors |
Whether local name handling and configuration work before network delivery is attempted |
| Message queues, then shows repeated deferrals | Read relay=, dsn=, and stat=; check MX resolution and port 25 reachability |
Whether the failure is DNS, routing, firewall, provider policy, or recipient response |
| Client receives “relaying denied” | Inspect client IP, recipient class, check_rcpt, check_relay, and the access map |
Which identity or policy rule rejected the relay request |
| TCP connects but TLS fails | Inspect SMTP capabilities and Sendmail TLS, certificate, and permission errors | Whether encryption and authentication can complete after connection |
| Hostname warnings appear at startup or delivery | Verify fully qualified hostname, forward DNS, and applicable reverse DNS | Whether Sendmail can construct a stable outbound identity |
10. Apply changes safely and verify the result
- Change one layer at a time: service configuration, listener, DNS identity, relay policy, network path, or TLS.
- Regenerate the effective Sendmail configuration whenever the distribution requires it, then reload or restart the correct service unit.
- If
/etc/mail/accesschanged, rebuild its database with the documentedmakemapprocedure before reloading Sendmail. - Tail the mail log while submitting exactly one controlled message.
- Confirm whether the log records local acceptance, queue deferral, relay acceptance, or final delivery status.
- Repeat the same test from the same client and recipient so that the before-and-after records are comparable.
Keep the previous working configuration available while testing. If a change removes the listener or causes startup failure, restore the last known-good generated configuration, inspect the journal, and correct the source rather than repeatedly restarting a broken daemon.
When to stop troubleshooting Sendmail locally
Escalate to the VPS provider when the daemon listens correctly, DNS is valid, and the VPS still cannot establish outbound TCP connections to recipient MX hosts. Ask specifically whether outbound port 25 is blocked for the instance and what authenticated submission ports are supported.
Escalate to the relay operator when the VPS can connect but the authenticated endpoint rejects credentials, TLS, or the sender domain. Supply the relay’s response and the matching Sendmail log record; do not remove TLS or broaden relay permissions merely to make a test appear successful.
For recipient-specific rejections, retain the destination’s SMTP response and the Sendmail dsn and stat fields. A remote policy decision cannot be repaired by changing the local listening socket.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
