Learn more about the role of DaemonPortOptions in Sendmail. Our Sendmail Support team is here to help you with your questions and concerns.

Understanding the Role of DaemonPortOptions in Sendmail

Sendmail is a widely-used mail transfer agent (MTA) that can run in one of the following two connection modes:

• As a daemon (accepting connections)
• As a client (making connections)

The `DaemonPortOptions` parameter allows administrators to control how the daemon handles incoming SMTP requests, including which ports it listens on.

By default, Sendmail listens on port 25 for SMTP traffic. However, for security reasons or to meet specific requirements, we may need to configure Sendmail to listen on a different port. This blog post will take us through configuring Sendmail to listen on a different port, such as 25000, instead of the default port 25.

An Overview:

1. Understanding DaemonPortOptions
2. Step-by-Step: Changing the Listening Port
3. 1. Verify the Current Listening Port
4. 2. Modify Sendmail Configuration
5. 3. Update /etc/services (Optional)
6. 4. Restart Sendmail
7. 5. Verify the Changes
8. Troubleshooting Common Issues
9. Understanding ClientPortOptions for Outbound Connections
10. Securing Sendmail with Firewall Rules
11. Common Pitfalls to Avoid

Understanding DaemonPortOptions

The `DaemonPortOptions` setting in Sendmail’s configuration file allows for fine-tuning how the daemon operates. This option is represented as a list of key-value pairs that specify various parameters, such as:

• Name: Name of the daemon (e.g., MTA)
• Port: The port number to listen on
• Family: Specifies the address family (IPv4 or Ipv6)
• Address: The IP address to bind to
• Listen: Backlog queue size for incoming connections

Here’s the general format:

O DaemonPortOptions=Name=MTA,Port=25000

Step-by-Step: Changing the Listening Port

 

1. Verify the Current Listening Port

Before making changes, verify the current port on which Sendmail is listening. Run the following commands:

# lssrc -s sendmail
# netstat -Aan | grep *.25


This checks if the daemon is active and if it’s listening on port 25.

2. Modify Sendmail Configuration

To change the port, edit the `sendmail.cf` file. Update the `DaemonPortOptions` to reflect the new port:

# vi /etc/mail/sendmail.cf

Change the line:

O DaemonPortOptions=Name=MTA

To:

O DaemonPortOptions=Name=MTA,Port=25000

3. Update /etc/services (Optional)

We can also modify the `/etc/services` file to associate the SMTP service with a new port:

# vi /etc/services

Change:

smtp 25/tcp

To:

smtp 25000/tcp

Note: If the ports in `/etc/mail/sendmail.cf` and `/etc/services` conflict, the configuration in `sendmail.cf` takes precedence.

4. Restart Sendmail

For changes to take effect, restart the Sendmail daemon:

# stopsrc -s sendmail
# startsrc -s sendmail -a "-bd -q30m"


5. Verify the Changes

Once restarted, confirm that Sendmail is listening on the new port (e.g., 25000):

# netstat -Aan | grep *.25000

This will show that the daemon is now bound to the updated port.

Troubleshooting Common Issues

If we run into issues after changing the port, consider the following troubleshooting steps:

• Ensure there are no conflicting configurations in `sendmail.cf` or `/etc/services`.
• Check if another process is using the new port by running `netstat -an`.
• If `/etc/mail/sendmail.cf` and `/etc/services` are configured with different ports, Sendmail will prioritize the `sendmail.cf` settings.

Understanding ClientPortOptions for Outbound Connections

While DaemonPortOptions handles incoming connections, ClientPortOptions manages outgoing connections. By default, Sendmail uses any available port for outbound SMTP traffic, but we can customize it for specific IPs and ports. This is useful for organizations managing multiple interfaces or enforcing network policies.

For example:

O ClientPortOptions=Family=inet, Address=192.168.1.100, Port=587

This ensures outbound connections use the specified IP and port, improving control and security over mail traffic. Properly configuring ClientPortOptions is essential for troubleshooting and managing mail routing.

Securing Sendmail with Firewall Rules

After configuring Sendmail to use a different port (e.g., 25000 instead of 25), ensure our firewall allows traffic on the new port. On CentOS/RHEL, update firewalld:

firewall-cmd --zone=public --add-port=25000/tcp --permanent
firewall-cmd –reload


Or for iptables:

iptables -A INPUT -p tcp --dport 25000 -j ACCEPT
service iptables save


Keep firewall rules updated to avoid blocking legitimate traffic. Secure your server by only allowing trusted IPs to access your mail server.

Common Pitfalls to Avoid

1. Changes in configuration won’t take effect until you restart Sendmail:

   stopsrc -s sendmail
startsrc -s sendmail -a "-bd -q30m"

2. Ensure our firewall reflects port changes to keep the server accessible.
3. Ensure sendmail.cf and /etc/services are consistent, as sendmail.cf settings take precedence.
4. Check for errors using:

   sendmail -C /etc/mail/sendmail.cf -bt -d0.1 < /dev/null

5. Regularly check /var/log/maillog for errors to catch issues early after configuration changes.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

By following the steps outlined above, we can easily configure Sendmail to listen on a different port. This setup is particularly useful for security or when using multiple MTAs on the same server. Properly configuring `DaemonPortOptions` ensures that our Sendmail daemon runs smoothly and securely on the desired port.

In brief, our Support Experts introduced us to the role of DaemonPortOptions in Sendmail.