Answers.Body: <p>An SPF record is recommended, but not the cause of the above error.</p>
  
  <p>That error message indicates failure to make a network connection from CiviCRM's mail library to the configured SMTP server.</p>
  
  <p>According to <a href="http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html</a>, port 587 is for STARTTLS connections. ("TLS" is an overloaded term used in a confusing sense here, don't sweat it.)</p>
  
  <p>It looks like you currently have a value of <code>ssl://email-smtp.us-west-2.amazonaws.com:587</code> in your Admin > System Settings > Outbound Email > SMTP Server field.</p>
  
  <p>I suggest you try using the following - please report back if one or both work?</p>
  
  <ul>
  <li><code>tls://email-smtp.us-west-2.amazonaws.com:587</code></li>
  <li><code>ssl://email-smtp.us-west-2.amazonaws.com:465</code></li>
  </ul>
  
  <p>I see that for optimal performance, <a href="https://hq.palantetech.coop/projects/commons/wiki/Amazon_SES_for_CiviCRM" rel="nofollow noreferrer">Palante recommend using a local Postfix MTA</a> which then routes email to Amazon SES. Make special note of the SMTP throttling warning at the bottom of that page.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-04-29T04:34:04.023Z
Answers.Text: Thanks for the suggestions, Chris.  I had already tried ssl:// with both ports (as well as port 25). I have now tried tls:// with both ports. Unfortunately, the result is the same: the timeout error.  I am on a shared server at 1and1, and don't think postfix is an option for me -- but perhaps I'm wrong on that?
Answers.UserDisplayName: user1147171
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-04-29T20:15:54.100Z
Answers.Text: Sorry, I don't know. I didn't even realise SES was available outside Amazon network, but [now I know otherwise](https://aws.amazon.com/ses/faqs/)! You might be hitting some network limits from 1and1, or something else ... If no-one else has the answer, I think your best bet will be to engage a developer who can debug it for you or to talk with 1and1 about your options. Shared hosting environments can be limiting for CiviCRM, so getting expert support may really help.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-04-29T20:17:31.893Z
Answers.Text: To debug further: If you have SSH access, I'd try using `openssl s_client` ([example](https://civicrm.stackexchange.com/questions/14255/how-to-get-iats-working/14555#14555)) to connect directly from your webhost to SES - just to establish that the connection can be made. If you lack that, I'd try some other SMTP method from the same hosting environment (eg Drupal SMTP module, or an equivalent).
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-01T05:10:40.953Z
Answers.Text: It turns out that our hosting company, 1and1, blocks SMTP other than their own. That explains all the connection timeouts.
Answers.UserDisplayName: user1147171
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-02T00:18:59.523Z
Answers.Text: Related question: https://civicrm.stackexchange.com/questions/18406/configuring-civicrm-for-1and1-email-limits
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-04-29T02:21:34.707Z
Answers.LastActivityDate: 2017-04-29T02:21:34.707Z
Answers.UserDisplayName: Chris Burgess
Body: <p>The Amazon SES account is verified.  I have sent emails from gmail using an alias that is the same address I'm using in CiviCRM, and the emails originating from gmail were delivered. But when I send a test email from Administer > System Settings > Outbound Email I consistently get a timeout error, like this:</p>
  
  <pre><code>Mail Not Sent
    Sending test email. FROM: info@mysite.org TO: verified@gmail.com.
    No test mail has been sent.
  
    An error occurred when CiviCRM attempted to send an email (via SMTP).
  
    The mail library returned the following error message:
    Failed to connect to ssl://email-smtp.us-west-2.amazonaws.com:587 [SMTP:
    Failed to connect socket: Connection timed out (code: -1, response: )]
  </code></pre>
  
  <p>Trying to figure out what the problem might be. I'm wondering if I might need an SPF record for my domain (mysite.org in the example above)?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-04-29T02:26:42.693Z
Comments.Text: see also: https://civicrm.stackexchange.com/questions/694/does-civimail-smtp-work-with-amazon-aws-ses?rq=1, https://civicrm.stackexchange.com/questions/2836/why-is-test-email-but-not-mail-campaigns-working-with-amazon-ses-with-civicrm?rq=1, https://civicrm.stackexchange.com/questions/12177/does-using-civimail-for-mailing-lists-on-aws-violate-the-aws-terms-of-service?rq=1
Comments.UserDisplayName: Chris Burgess
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-01T02:42:38.440Z
Comments.Text: I recommend at least SPF 30 as it's possible to get a sunburn even under the amazon clouds.
Comments.UserDisplayName: Coleman
Tags: <smtp><amazon-ses>
Title: Is an SPF Record required to get CiviCRM to work with Amazon SES? (1and1 hosting)
ThreadText: # Is an SPF Record required to get CiviCRM to work with Amazon SES? (1and1 hosting)
  
  (Asked by: username_0 on 2017-04-29)
  
  The Amazon SES account is verified.  I have sent emails from gmail using an alias that is the same address I'm using in CiviCRM, and the emails originating from gmail were delivered. But when I send a test email from Administer > System Settings > Outbound Email I consistently get a timeout error, like this:
  Mail Not Sent
    Sending test email. FROM: info@mysite.org TO: verified@gmail.com.
    No test mail has been sent.
  
    An error occurred when CiviCRM attempted to send an email (via SMTP).
  
    The mail library returned the following error message:
    Failed to connect to ssl://email-smtp.us-west-2.amazonaws.com:587 [SMTP:
    Failed to connect socket: Connection timed out (code: -1, response: )]
  
  Trying to figure out what the problem might be. I'm wondering if I might need an SPF record for my domain (mysite.org in the example above)?
  
  **Tags:** smtp, amazon-ses
  
  > **Comments:**
  > **username_1**: see also: https://civicrm.stackexchange.com/questions/694/does-civimail-smtp-work-with-amazon-aws-ses?rq=1, https://civicrm.stackexchange.com/questions/2836/why-is-test-email-but-not-mail-campaigns-working-with-amazon-ses-with-civicrm?rq=1, https://civicrm.stackexchange.com/questions/12177/does-using-civimail-for-mailing-lists-on-aws-violate-the-aws-terms-of-service?rq=1  
  > **username_2**: I recommend at least SPF 30 as it's possible to get a sunburn even under the amazon clouds.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-04-29. Score: 1
  
  An SPF record is recommended, but not the cause of the above error.
  
  That error message indicates failure to make a network connection from CiviCRM's mail library to the configured SMTP server.
  
  According to <http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html>, port 587 is for STARTTLS connections. ("TLS" is an overloaded term used in a confusing sense here, don't sweat it.)
  
  It looks like you currently have a value of `ssl://email-smtp.us-west-2.amazonaws.com:587` in your Admin > System Settings > Outbound Email > SMTP Server field.
  
  I suggest you try using the following - please report back if one or both work?
  
  * `tls://email-smtp.us-west-2.amazonaws.com:587`
  * `ssl://email-smtp.us-west-2.amazonaws.com:465`
  
  I see that for optimal performance, [Palante recommend using a local Postfix MTA](https://hq.palantetech.coop/projects/commons/wiki/Amazon_SES_for_CiviCRM) which then routes email to Amazon SES. Make special note of the SMTP throttling warning at the bottom of that page.
  
  > **Comments:**
  > **username_0**: Thanks for the suggestions, Chris.  I had already tried ssl:// with both ports (as well as port 25). I have now tried tls:// with both ports. Unfortunately, the result is the same: the timeout error.  I am on a shared server at 1and1, and don't think postfix is an option for me -- but perhaps I'm wrong on that?  
  > **username_1**: Sorry, I don't know. I didn't even realise SES was available outside Amazon network, but [now I know otherwise](https://aws.amazon.com/ses/faqs/)! You might be hitting some network limits from 1and1, or something else ... If no-one else has the answer, I think your best bet will be to engage a developer who can debug it for you or to talk with 1and1 about your options. Shared hosting environments can be limiting for CiviCRM, so getting expert support may really help.  
  > **username_1**: To debug further: If you have SSH access, I'd try using `openssl s_client` ([example](https://civicrm.stackexchange.com/questions/14255/how-to-get-iats-working/14555#14555)) to connect directly from your webhost to SES - just to establish that the connection can be made. If you lack that, I'd try some other SMTP method from the same hosting environment (eg Drupal SMTP module, or an equivalent).  
  > **username_0**: It turns out that our hosting company, 1and1, blocks SMTP other than their own. That explains all the connection timeouts.  
  > **username_1**: Related question: https://civicrm.stackexchange.com/questions/18406/configuring-civicrm-for-1and1-email-limits  
  
  ---
  
  