A Sendmail process can be running while no daemon listens on the expected SMTP port, while messages remain queued, or while a provider blocks outbound delivery. Fix the failure by checking the service, listening socket, mail log, queue, DNS identity, relay policy, port 25 connectivity, and TLS in that order.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Do not treat a successful local submission as proof of delivery. It only proves that the message entered the local mail system. The log and queue show whether Sendmail handed it to a remote server, deferred it for retry, or rejected it before delivery.
As an Amazon Associate I earn from qualifying purchases.
What “Sendmail is not working” can mean
Several different failures produce the same symptom from an application’s point of view. A daemon may be stopped, or it may run without binding to port 25. A local message may be accepted but deferred because DNS, a firewall, or the recipient’s MX server is unreachable. A remote server may reject the message because your host is not authorized to relay. TLS negotiation can fail after a TCP connection has already succeeded.
Use the first matching branch below rather than changing configuration at random:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Local submission fails: investigate the Sendmail service, permissions, aliases, syntax, and local configuration.
- Submission succeeds but the queue grows: investigate DNS, recipient-MX reachability, outbound TCP 25, TLS, and remote policy.
- The log says “relay denied” or returns a 550 response: inspect the connecting client, recipient class, relay rules, and access database. Do not enable unrestricted relaying.
- Applications connect but SMTP commands fail: compare the listener’s address and port with the client’s settings, then test TLS independently.
1. Confirm the package, service, and version
Distribution packaging differs, so do not assume that every VPS uses the same unit name. First identify the installed package and the unit that owns the daemon.
rpm -qa | grep -i sendmail
# or, on Debian-based systems:
dpkg -l | grep -i sendmail
systemctl list-unit-files | grep -i sendmail
systemctl status sendmailIf sendmail.service is absent, the unit may have a distribution-specific name. Use the name returned by systemctl list-unit-files for the remaining status, restart, and journal commands. Inspect recent startup messages before restarting:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo journalctl -u sendmail --since "30 minutes ago" --no-pager
sudo systemctl status sendmail --no-pagerCheck the installed version using the package manager’s version query. On installations that support Sendmail’s diagnostic output, sendmail -d0.4 -bv root prints build information while verifying a name; it does not send a message. Record the version before changing files because syntax and generated configuration can vary between releases.
A service reported as active (running) is only one fact. Continue to the socket check; Red Hat documents cases where Sendmail runs but does not listen on port 25, or listens on port 587 instead.
2. Verify the listening socket
Check every SMTP port that might be configured and note both the local address and the process ID:
sudo ss -ltnp | grep -E ':(25|465|587)b'Interpret the result precisely:
0.0.0.0:25or[::]:25indicates a listener reachable on the VPS interfaces, subject to firewall rules.127.0.0.1:25or::1:25accepts connections only from the VPS itself. A remote application or another host cannot use it.- A listener on
587but none on25may be intentional submission-only configuration, or it may reflect an incorrectDAEMON_OPTIONSsetting. - No matching line means the daemon is not listening, regardless of what the service status says.
Compare the observed address and port with /etc/mail/sendmail.mc and the generated sendmail.cf. Pay particular attention to DAEMON_OPTIONS, which controls daemon interfaces and ports. If you edit the macro configuration, regenerate the effective configuration using the method supplied by your distribution, then reload or restart the service and run ss again. Do not assume that editing sendmail.mc changes a currently running daemon until the generated file has been rebuilt and loaded.
Recommended Free Tools
For a local-only submission design, binding to loopback is appropriate; configure the application to use that same address and port. For remote SMTP clients, bind to an externally reachable interface and restrict access with a firewall and relay policy rather than exposing an unrestricted server.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
3. Read the mail log while reproducing one test
Sendmail writes through syslog’s LOG_MAIL facility. Common destinations are /var/log/maillog and /var/log/syslog; some systems use /var/log/mail.log. Follow the file that exists on your VPS while submitting one controlled message.
sudo tail -F /var/log/maillog /var/log/mail.log /var/log/syslogUse a separate shell to submit the test, then stop following files that do not exist. A single test is easier to correlate than a batch of application messages. In each record, capture the queue identifier and inspect these fields:
relay=identifies the host to which Sendmail attempted delivery.dsn=gives the enhanced delivery-status code, such as a temporary or permanent failure class.stat=states whether delivery succeeded, was deferred, or failed.status=, when present, provides a normalized result used by some logging formats.- Connection timeouts, DNS lookup errors, authentication failures, certificate errors, and explicit 550 responses identify different remediation paths.
Sendmail’s operations documentation distinguishes receipt records from delivery-attempt records. A message can therefore appear to be accepted and later produce several delivery attempts when it is deferred. Do not delete a queued message merely because the first attempt failed; first determine whether the error is temporary and whether the retry interval is working.
4. Separate local acceptance from remote delivery
Submit a single test message from the VPS using the same local path your application uses. Then inspect the queue:
mailqIf the message receives a queue ID and appears in the queue, local Sendmail accepted it. That result does not establish that a recipient server accepted it. Use the log entry associated with that queue ID to see whether Sendmail delivered, deferred, or rejected the message.
Classify the result before making changes:
- No queue ID and an immediate local error: check the service socket, local permissions, aliases, configuration syntax, and the application’s SMTP settings.
- Queue ID followed by a successful status: Sendmail completed its SMTP transaction with the relay or recipient shown in
relay=. Any later mailbox filtering is outside this daemon’s control. - Queue ID followed by deferred status: investigate DNS, remote-MX connectivity, port 25 filtering, TLS, or a temporary remote response.
- Permanent 5xx status: correct the address, sender identity, relay authorization, or remote-policy issue before retrying.
When troubleshooting, send one message to a domain you control or can monitor. Avoid using a production mailing list because repeated retries can obscure the original error and create a second deliverability problem.
5. Use Sendmail’s non-delivery diagnostics
Verify an address without sending
Run:
sendmail -bv [email protected]The -bv mode verifies names without collecting or delivering a message. It exercises aliasing and address qualification, so it can reveal malformed local addresses or an unexpected rewrite without creating another queue entry.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Inspect address rewriting and rules
Run:
sendmail -btThis enters address-test mode. Use it to examine how the active configuration rewrites a sender or recipient and to investigate rules that affect relay checks. Exit the interactive session with the command appropriate to your build. Because -bt reads the effective configuration, run it after regenerating sendmail.cf; otherwise you may debug a file that is no longer in use.
These two modes are deliberately safer than repeatedly sending test mail: -bv validates names, while -bt tests the rule set without attempting remote delivery.
6. Check hostname and DNS qualification
Sendmail needs a stable identity for the local host and for outbound SMTP transactions. Verify the effective hostname and resolver behavior before editing rewrite rules:
hostname -f
hostnamectl status
getent hosts "$(hostname -f)"
getent hosts example.comThe VPS should have a fully qualified hostname that resolves in forward DNS. Where your provider and address space support it, configure reverse DNS (PTR) that is consistent with that hostname. A host that cannot qualify its own name can delay startup, produce malformed outbound identity, or create confusing log entries.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor a deferred recipient, resolve the recipient domain’s MX records from the VPS:
dig +short MX example.comIf dig is unavailable, use the resolver tools supplied by your distribution. Confirm that the returned MX hostnames themselves resolve to addresses. A missing or failing lookup points to resolver or DNS configuration, not to an SMTP relay rule. Do not “fix” a DNS failure by hard-coding a recipient IP; MX priorities and address changes are part of normal delivery.
7. Fix “relaying denied” without opening the server
Sendmail 8.9 and later deny relaying by default. The default protects a VPS from becoming an open relay, so a 550-style relay error is a policy decision rather than proof that the daemon is broken.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Read the complete log line and identify three facts:
- The connecting client address or authenticated identity.
- Whether the recipient is a local domain, a configured relay domain, or an external domain.
- The exact rule or access-map result that produced the rejection.
Check local domain and relay configuration in the active files, commonly including /etc/mail/local-host-names, /etc/mail/access, and the generated sendmail.cf. Your distribution may use additional relay classes or macro definitions. Use sendmail -bt to inspect the check_rcpt and check_relay paths and to test how a recipient and client address are classified. An access-map lookup should answer whether the connecting host, user, or domain has an explicit permission.
If you change /etc/mail/access, rebuild its database before reloading Sendmail. A typical hash-map rebuild is:
sudo makemap hash /etc/mail/access < /etc/mail/accessUse the map type and file location documented for your distribution if they differ. Then reload or restart the Sendmail unit and reproduce one test while watching the log. A text-file edit without a database rebuild leaves the daemon using the old entries.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Grant the narrowest permission that meets the requirement: a specific application host, an authenticated user, or a clearly defined internal domain. Do not add a wildcard permit, allow every external recipient, or disable relay checks merely to make the error disappear. An unrestricted relay can be abused to send spam and can rapidly damage the VPS address’s reputation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Test outbound port 25 and provider policy
Direct delivery requires the VPS to reach recipient MX servers over outbound TCP 25. Fedora’s administration guidance identifies port 25 as Sendmail’s default SMTP port and notes that a firewall or upstream provider can block it.
After resolving an MX host, test the path from the VPS:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
dig +short MX example.com
nc -vz mx.example.com 25Replace mx.example.com with an actual host returned by the MX lookup. A timeout commonly indicates filtering or a broken route. An immediate refusal means that the destination or an intermediary rejected the connection. Neither result automatically proves a Sendmail syntax problem.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Check local egress rules as well as provider policy. A host firewall may allow inbound SMTP while denying outbound port 25. Some VPS networks impose a provider-level block, especially on newly created instances. Ask the provider whether outbound TCP 25 is restricted and whether an unblock request is required. Test more than one recipient MX when possible; a single destination can be temporarily unavailable.
If the provider blocks direct delivery, use an authenticated SMTP submission relay on the provider’s supported port. Treat this as an architecture change, not a one-line workaround. Configure the relay hostname, submission port, credentials, and TLS requirements; then verify that the relay accepts the envelope sender and recipient. Continue to monitor Sendmail’s queue and logs, because the local daemon still owns retries even though the relay performs the external delivery.
9. Test STARTTLS independently
A successful TCP connection proves only that a socket opened. It does not prove that the server advertises STARTTLS, that certificates are readable, or that authentication will complete.
Inspect the local SMTP capability exchange:
openssl s_client -starttls smtp -connect 127.0.0.1:25 -crlfUse the externally reachable address and configured submission port when testing a remote listener. After the server banner, issue EHLO test.example and check whether 250-STARTTLS appears. Do not enter real credentials during a diagnostic session.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review Sendmail logs for certificate validation failures, unreadable key files, unsafe-file warnings, protocol-version errors, and authentication failures. File ownership and permissions matter: a daemon that cannot read its certificate or private key can accept plain SMTP while failing every TLS attempt. Correct the file issue, reload the service, and repeat the capability test before testing application authentication.
Keep listener, relay-policy, and TLS tests separate. A missing listener is fixed in daemon options; a 550 relay response is fixed in authorization rules; a handshake or certificate error is fixed in TLS configuration. Combining all three changes makes the original cause difficult to identify.
Direct delivery versus an authenticated relay
Choose the delivery architecture that matches the VPS network and the domain’s reputation requirements.
| Consideration | Direct-to-recipient delivery | Authenticated SMTP relay |
|---|---|---|
| Outbound port | Requires reliable outbound TCP 25 access to recipient MX servers. | Uses the relay provider’s supported submission port; the VPS may not need unrestricted port 25. |
| Authentication | Usually relies on the sending host’s identity and recipient policy. | Requires configured relay credentials or another supported authentication method. |
| TLS | Must negotiate TLS separately with each recipient that offers it. | Must meet the relay’s TLS and authentication requirements. |
| DNS and reverse DNS | Stable hostname, forward DNS, and applicable reverse DNS are important to acceptance. | The relay handles much of the external sender reputation, but your envelope and header identity still need to be valid. |
| Queue and retries | Sendmail queues and retries each recipient-MX connection. | Sendmail queues and retries the connection to the relay; the relay then handles downstream delivery. |
| Observability | Logs show each recipient-MX connection and response. | Logs show the relay transaction; downstream details may be available only from the relay. |
| Provider policy | Fails if the VPS network blocks port 25 or the address has poor reputation. | Often works when direct SMTP is blocked, provided the relay account permits the sender and recipient. |
Use direct delivery only when outbound port 25, DNS identity, and operational monitoring are dependable. Prefer an authenticated relay when the VPS provider blocks direct SMTP or when maintaining recipient-MX connectivity and reputation is outside your operational capacity.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSymptom-to-action checklist
| Observed symptom | Evidence to collect | Next action |
|---|---|---|
| Service is active but no port 25 listener appears | systemctl status, journal, and ss -ltnp output |
Review DAEMON_OPTIONS, regenerate the effective configuration, and reload the correct unit. |
| Listener is bound only to loopback | Socket address shows 127.0.0.1 or ::1 |
Use a local submission client or bind the daemon to the required interface with firewall restrictions. |
| Message is accepted, then deferred | Queue ID plus dsn=, stat=, relay=, and timeout or DNS text |
Resolve MX records, test connectivity, and check port 25 and TLS. |
| 550 relay denial | Client address, recipient class, and access-map or check_rcpt/check_relay result |
Permit only the required client or user, rebuild the access database, and reload. |
| TCP connects but STARTTLS fails | Capability exchange and certificate or authentication errors in the log | Fix certificate readability, names, permissions, or TLS settings, then retest. |
| Remote port 25 times out | MX lookup and a connection test from the VPS | Check local egress rules and provider blocking; move to an authenticated relay if direct SMTP is unavailable. |
Final verification
After the correction, submit one controlled message and follow its queue ID from acceptance to completion. Confirm that the log records the intended relay, a successful delivery status, and no new deferred copy. Then test the application’s actual SMTP settings, including hostname, port, authentication, and TLS mode. Keep the restrictive relay policy and firewall rules that made the test safe; a working message path is not a reason to expose an open relay.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
