Hello Helpbot.
I have a webapp (specifically Nextcloud) that needs to send email. I need it send via my stalwart mail server.
Nextcloud can accept credentials of username and password and transfer mail to stalwart via SMTP.
I have created a user account on stalwart but the emails fail either with: Relay not allowed. listenerId = "smtp", localPort = 25, remoteIp = 123.456.789.123, remotePort = 54940, to = "[email protected]"
or listenerId = "submissions", localPort = 465, remoteIp = 123.456.789.123, remotePort = 43800, reason = "Failed to decode token. If you are using an external OIDC provider, make sure it is configured as the default directory under the Authentication object.", causedBy = "crates/common/src/auth/oauth/token.rs:87", details = "thepassword", remoteIp = 123.456.789.123
How can I configure Stalwart to accept emails and relay from my nextcloud server?
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
Two separate issues are happening here, both in your SMTP client (Nextcloud) configuration:
1. “Relay not allowed” on port 25
Port 25 (listenerId = "smtp") is the unauthenticated inbound MTA listener meant for receiving mail from the internet, not for client submission. By default, authentication is neither offered nor required on port 25 (require defaults to true only when local_port != 25), so a connection there is always treated as unauthenticated, and unauthenticated senders can’t relay to outside domains. Don’t send through port 25. Point Nextcloud at the submission port instead: 465 (implicit TLS) or 587 (STARTTLS).
2. “Failed to decode token” on port 465 (submissions)
This means Stalwart received an AUTH OAUTHBEARER/AUTH XOAUTH2 exchange and tried to validate your literal password as if it were an OAuth bearer token (you can see details = "thepassword" in the log — your plaintext password ended up where a token was expected). This happens if Nextcloud’s SMTP auth-type setting is set to an OAuth2 mechanism instead of plain username/password. Check Nextcloud’s mail server settings and make sure the authentication method is set to LOGIN or PLAIN, not XOAUTH2/OAuth2.
By default Stalwart’s submission listeners over TLS (465, and STARTTLS 587) offer plain, login, oauthbearer, and xoauth2 as SASL mechanisms, so once Nextcloud sends a normal AUTH LOGIN/AUTH PLAIN with the account’s username and password, authentication should succeed. Once authenticated, relaying to external addresses is allowed by default, since the default allowRelaying policy permits it whenever the session is authenticated.
Thank you helpbot.
For future readers, I’m not certain this was the solution;
somehow I didn’t have 587/start tls enabled so I added it via network > listeners and the notes in the docs Listeners | Stalwart )
I was still getting the error, so I looked more into Nextcloud which said it tried authentication in order of [CramMd5,Login,Plain,XOAuth2]. I didn’t notice the stalwart log saying a login attempt was made with cram, login or plain, before the error i posted here. I checked the nextcloud log and it looked like it was trying those first.
I tried setting an app password but I think I set that in the ‘admin’ user instead of logging in as the sending user account. I got the same errors and then realised my mistake so set the admin email as the sender in nextcloud, same errors.
Then I had break, came back, set the app password from the user email account on stalwart, changed the email back to the user eamil in nextcloud, tried the test message … and it worked.
I think there is a real possibility I had misspelt my new user email address in Nextcloud. I notice now the error message in stalwart when sending to port 465 (above, and looking at my logs again to see the error for port 587) don’t include the username trying to connect.
So, I think the problem was once again my misspelling something. I hope that helps someone else!