Mail fails for emergency contacts (and emergency contacts only) #1184

Closed
opened 2026-02-05 00:14:58 +03:00 by OVERLORD · 8 comments
Owner

Originally created by @juriansluiman on GitHub (Jan 6, 2022).

Mail sending fails for emergency contacts only

Mail in vaultwarden works. However every mail related to emergency contacts (invite + resend) gives me an SMTP error. This is odd since e.g. a password hint mail is successfully sent.

Deployment environment

I can't find the generate support string button Here's a short description:

  • vaultwarden version: vaultwarden/server:1.23.1-alpine (latest stable)
  • Install method: docker image from docker hub
  • Clients used: web vault
  • Reverse proxy and version: Traefik version 2.5.6 (latest stable)
  • MySQL/MariaDB or PostgreSQL version: Running SQLite
  • Other relevant details:

Steps to reproduce

  1. Login web vault, go to settings, go to Emergency Access
  2. Click 'Add emergency access'
  3. Enter email address (I used an existing vaultwarden user)
  4. Message in web vault "SMTP 5xx error: permanent error (511)"

Expected behaviour

At step 4: successfully created an emergency contact

Actual behaviour

At step 4: error message and no emergency contact is created

Troubleshooting data

Mail does work, sending a password hint:

mail
The logging data of this password hint mail:

POST /api/accounts/password-hint application/json; charset=utf-8:
POST /api/accounts/password-hint
    => Matched: POST /api/accounts/password-hint (password_hint)
    => Outcome: Success
POST /api/accounts/password-hint (password_hint) => 200 OK
    => Response succeeded.

The error message after creating an emergency contact:
error

The logging data:

POST /api/emergency-access/invite application/json; charset=utf-8:
POST /api/emergency-access/invite
    => Matched: POST /api/emergency-access/invite (send_invite)
Error: SMTP 5xx error: permanent error (551)
    => Outcome: Success
POST /api/emergency-access/invite (send_invite) => 400 Bad Request
    => Response succeeded.

Eventually the contact is in the vaultwarden database:
contact

But a reminder mail gets the same result:

POST /api/emergency-access/3ca2895b-77df-4cc6-9313-8bc991152962/reinvite:
POST /api/emergency-access/3ca2895b-77df-4cc6-9313-8bc991152962/reinvite
    => Matched: POST /api/emergency-access/<emer_id>/reinvite (resend_invite)
Error: SMTP 5xx error: permanent error (551)
    => Outcome: Success
POST /api/emergency-access/<emer_id>/reinvite (resend_invite) => 400 Bad Request
    => Response succeeded.

Mail SMTP info:

  • Using Fastmail
  • SMTP credentials are specific for Vaultwarden
  • SMTP integration works, proven by password hint

Fastmail config:

SMTP_HOST: "smtp.fastmail.com"
SMTP_FROM: "<redacted>"
SMTP_PORT: "587"
SMTP_SSL: "true"
SMTP_USERNAME: "<redacted>"
SMTP_PASSWORD: "<redacted>"
SMTP_DEBUG: "true"

I can't generate more logging afaik, my docker container has already max log level (SMTP debug and env vars below):

$ docker inspect bitwarden --format '{{json .Config.Env }}' | jq -r '' -M | grep LOG
  "LOG_FILE=/bitwarden.log",
  "LOG_LEVEL=debug",
  "EXTENDED_LOGGING=true",
Originally created by @juriansluiman on GitHub (Jan 6, 2022). ### Mail sending fails for emergency contacts only Mail in vaultwarden works. However every mail related to emergency contacts (invite + resend) gives me an SMTP error. This is odd since e.g. a password hint mail is successfully sent. ### Deployment environment I can't find the generate support string button :question: Here's a short description: * vaultwarden version: vaultwarden/server:1.23.1-alpine (latest stable) * Install method: docker image from docker hub * Clients used: web vault * Reverse proxy and version: Traefik version 2.5.6 (latest stable) * MySQL/MariaDB or PostgreSQL version: Running SQLite * Other relevant details: ### Steps to reproduce 1. Login web vault, go to settings, go to Emergency Access 2. Click 'Add emergency access' 3. Enter email address (I used an existing vaultwarden user) 4. Message in web vault "SMTP 5xx error: permanent error (511)" ### Expected behaviour At step 4: successfully created an emergency contact ### Actual behaviour At step 4: error message and no emergency contact is created ### Troubleshooting data Mail does work, sending a password hint: ![mail](https://user-images.githubusercontent.com/705925/148386105-7ebc7d07-4777-4b26-9ccc-0969353c0b47.png) The logging data of this password hint mail: ``` POST /api/accounts/password-hint application/json; charset=utf-8: POST /api/accounts/password-hint => Matched: POST /api/accounts/password-hint (password_hint) => Outcome: Success POST /api/accounts/password-hint (password_hint) => 200 OK => Response succeeded. ``` The error message after creating an emergency contact: ![error](https://user-images.githubusercontent.com/705925/148386235-c508f0b9-31b8-4640-ab6c-6390673ad862.png) The logging data: ``` POST /api/emergency-access/invite application/json; charset=utf-8: POST /api/emergency-access/invite => Matched: POST /api/emergency-access/invite (send_invite) Error: SMTP 5xx error: permanent error (551) => Outcome: Success POST /api/emergency-access/invite (send_invite) => 400 Bad Request => Response succeeded. ``` Eventually the contact is in the vaultwarden database: ![contact](https://user-images.githubusercontent.com/705925/148386312-e82ba796-2c5c-4e09-a71c-7de44d979070.png) But a reminder mail gets the same result: ``` POST /api/emergency-access/3ca2895b-77df-4cc6-9313-8bc991152962/reinvite: POST /api/emergency-access/3ca2895b-77df-4cc6-9313-8bc991152962/reinvite => Matched: POST /api/emergency-access/<emer_id>/reinvite (resend_invite) Error: SMTP 5xx error: permanent error (551) => Outcome: Success POST /api/emergency-access/<emer_id>/reinvite (resend_invite) => 400 Bad Request => Response succeeded. ``` Mail SMTP info: - Using Fastmail - SMTP credentials are specific for Vaultwarden - SMTP integration works, proven by password hint Fastmail config: ``` SMTP_HOST: "smtp.fastmail.com" SMTP_FROM: "<redacted>" SMTP_PORT: "587" SMTP_SSL: "true" SMTP_USERNAME: "<redacted>" SMTP_PASSWORD: "<redacted>" SMTP_DEBUG: "true" ``` I can't generate more logging afaik, my docker container has already max log level (SMTP debug and env vars below): ``` $ docker inspect bitwarden --format '{{json .Config.Env }}' | jq -r '' -M | grep LOG "LOG_FILE=/bitwarden.log", "LOG_LEVEL=debug", "EXTENDED_LOGGING=true", ```
Author
Owner

@BlackDex commented on GitHub (Jan 7, 2022):

It doesn't look like the SMTP_DEBUG is really enabled, else you would have received more logging.
Could you please post the Support String which you can generate via the /admin/diagnostics page.

@BlackDex commented on GitHub (Jan 7, 2022): It doesn't look like the SMTP_DEBUG is really enabled, else you would have received more logging. Could you please post the `Support String` which you can generate via the /admin/diagnostics page.
Author
Owner

@juriansluiman commented on GitHub (Jan 7, 2022):

Ah I found out via the wiki how to enable the admin 🤦‍♂️

This is the support string:

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.23.1
  • Web-vault version: v2.25.0
  • Running within Docker: true (Base: Alpine)
  • Environment settings overridden: true
  • Uses a reverse proxy: true
  • IP Header check: true (X-Real-IP)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Time Check: true
  • Domain Configuration Check: true
  • HTTPS Check: true
  • Database type: SQLite
  • Database version: 3.35.4
  • Clients used:
  • Reverse proxy and version:
  • Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, SIGNUPS_DOMAINS_WHITELIST, SHOW_PASSWORD_HINT, ADMIN_TOKEN, SMTP_HOST, SMTP_SSL, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_ip_header_enabled": true,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_max_conns": 10,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****.****.**",
  "domain_origin": "*****://*****.****.**",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 5 * * * *",
  "emergency_request_timeout_schedule": "0 5 * * * *",
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": "/bitwarden.log",
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "org_attachment_limit": null,
  "org_creation_users": "",
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "****.**",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": true,
  "smtp_explicit_tls": false,
  "smtp_from": "*********@****.**",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "****.********.***",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": "******@****.**",
  "templates_folder": "data/templates",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": true,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

My 2cts: now I found the admin page, I also tried to send a test mail from there, this worked too ✔️
Secondly, the support string does contain smtp_debug: true but I don't see any additional logging either.

@juriansluiman commented on GitHub (Jan 7, 2022): Ah I found out via the wiki how to enable the admin :man_facepalming: This is the support string: ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.23.1 * Web-vault version: v2.25.0 * Running within Docker: true (Base: Alpine) * Environment settings overridden: true * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Database type: SQLite * Database version: 3.35.4 * Clients used: * Reverse proxy and version: * Other relevant information: ### Config (Generated via diagnostics page) <details><summary>Show Running Config</summary> **Environment settings which are overridden:** DOMAIN, SIGNUPS_ALLOWED, SIGNUPS_DOMAINS_WHITELIST, SHOW_PASSWORD_HINT, ADMIN_TOKEN, SMTP_HOST, SMTP_SSL, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": true, "_ip_header_enabled": true, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "authenticator_disable_time_drift": false, "data_folder": "data", "database_max_conns": 10, "database_url": "****/**.*******", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*****.****.**", "domain_origin": "*****://*****.****.**", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 5 * * * *", "emergency_request_timeout_schedule": "0 5 * * * *", "enable_db_wal": true, "extended_logging": true, "helo_name": null, "hibp_api_key": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": "/bitwarden.log", "log_level": "Info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "org_attachment_limit": null, "org_creation_users": "", "password_iterations": 100000, "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "****.**", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": true, "smtp_explicit_tls": false, "smtp_from": "*********@****.**", "smtp_from_name": "Vaultwarden", "smtp_host": "****.********.***", "smtp_password": "***", "smtp_port": 587, "smtp_ssl": true, "smtp_timeout": 15, "smtp_username": "******@****.**", "templates_folder": "data/templates", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": true, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> My 2cts: now I found the admin page, I also tried to send a test mail from there, this worked too :heavy_check_mark: Secondly, the support string does contain `smtp_debug: true` but I don't see any additional logging either.
Author
Owner

@BlackDex commented on GitHub (Jan 7, 2022):

It indeed looks like all is configured ok.
The thing is, if e-mail works for the rest of the items, then there must be something on the server side which blocks this.
A 5XX error is not something generated by the application or library, it's just what is returned by the SMTP Server.
Sometimes some mail server tend to block some mails because of some content which they mark as spam/fraudulent and return 5XX errors.

I don't know how you started the container, with either docker-compose or just docker, but in both cases i would recommend to remove the container, do a pull to make sure you have the latest version and create the container again to make sure all the current settings are loaded in case something is weird there.

With docker-compose this would be enough:

docker-compose down
docker-compose pull
docker-compose up -d

With docker (and i use bitwarden here since you seem to have the container named that way):

docker rm --force bitwarden
docker pull vaultwarden/server:1.23.1-alpine
docker run .......

Also, could you try to use the testing tagged version vaultwarden/server:testing-alpine and see if that solves some issues?

@BlackDex commented on GitHub (Jan 7, 2022): It indeed looks like all is configured ok. The thing is, if e-mail works for the rest of the items, then there must be something on the server side which blocks this. A 5XX error is not something generated by the application or library, it's just what is returned by the SMTP Server. Sometimes some mail server tend to block some mails because of some content which they mark as spam/fraudulent and return 5XX errors. I don't know how you started the container, with either docker-compose or just docker, but in both cases i would recommend to remove the container, do a pull to make sure you have the latest version and create the container again to make sure all the current settings are loaded in case something is weird there. With docker-compose this would be enough: ```bash docker-compose down docker-compose pull docker-compose up -d ``` With docker (and i use bitwarden here since you seem to have the container named that way): ```bash docker rm --force bitwarden docker pull vaultwarden/server:1.23.1-alpine docker run ....... ``` Also, could you try to use the `testing` tagged version `vaultwarden/server:testing-alpine` and see if that solves some issues?
Author
Owner

@juriansluiman commented on GitHub (Jan 12, 2022):

A switch to testing did not help this issue. Everything is provisioned via Ansible so things will update smoothly 😄

However, I found out something else. This does not happen because of emergency access. This does happen with a single user in my account (!). I get the same SMTP errors when I send the user an invite, for example. I verified this when SMTP test mails in the admin panel.

Example: mail on example.com with user1 and user2. I also have aliases alias1 -> user1 and alias2 -> user2 and alias12 -> user1 and user2 get the mail. Below tests from admin panel:

  1. user1@example.com: success
  2. user2@example.com: SMTP error 551
  3. alias1@example.com: success
  4. alias2@example.com: SMTP error 551
  5. alias12@example.com: success but only user1 gets the mail

This behavior occurs only with Vaultwarden, any other apps I use SMTP with, do just work fine as expected. Because of the errors alias2@example.com I expect this is an err on the side of Fastmail. I opened a ticket to get their support. When they confirm I can close this one.

One more thing: I do have the ENV set for SMTP_DEBUG but I don't get any SMTP logging in my stdout. The flag is set when inspecting the container with docker inspect. Why does SMTP_DEBUG not trigger SMTP logging? For the fastmail ticket they require the bounce message and without SMTP_DEBUG enabled I'm afraid I can't get the debugging message out?

@juriansluiman commented on GitHub (Jan 12, 2022): A switch to testing did not help this issue. Everything is provisioned via Ansible so things will update smoothly :smile: However, I found out something else. This does **not** happen because of emergency access. This **does happen** with a single user in my account (!). I get the same SMTP errors when I send the user an invite, for example. I verified this when SMTP test mails in the admin panel. Example: mail on example.com with user1 and user2. I also have aliases alias1 -> user1 and alias2 -> user2 and alias12 -> user1 and user2 get the mail. Below tests from admin panel: 1. user1@example.com: success 2. user2@example.com: SMTP error 551 3. alias1@example.com: success 4. alias2@example.com: SMTP error 551 5. alias12@example.com: success but only user1 gets the mail This behavior occurs only with Vaultwarden, any other apps I use SMTP with, do just work fine as expected. Because of the errors alias2@example.com I expect this is an err on the side of Fastmail. I opened a ticket to get their support. When they confirm I can close this one. *One more thing*: I do have the ENV set for SMTP_DEBUG but I don't get any SMTP logging in my stdout. The flag is set when inspecting the container with `docker inspect`. Why does SMTP_DEBUG not trigger SMTP logging? For the fastmail ticket they require the bounce message and without SMTP_DEBUG enabled I'm afraid I can't get the debugging message out?
Author
Owner

@juriansluiman commented on GitHub (Jan 12, 2022):

It was indeed a configuration issue at Fastmail's side 😄

@juriansluiman commented on GitHub (Jan 12, 2022): It was indeed a configuration issue at Fastmail's side :smile:
Author
Owner

@BlackDex commented on GitHub (Jan 12, 2022):

@juriansluiman Glad you have found the issue.
Though, regarding the SMTP_DEBUG, when you restart Vaultwarden you should see the following message:

[WARNING] SMTP Debugging is enabled (SMTP_DEBUG=true). Sensitive information could be disclosed via logs!
[WARNING] Only enable SMTP_DEBUG during troubleshooting!

Do you see that message at all?
If not, then it doesn't seem to be enabled at all.

@BlackDex commented on GitHub (Jan 12, 2022): @juriansluiman Glad you have found the issue. Though, regarding the `SMTP_DEBUG`, when you restart Vaultwarden you should see the following message: ``` [WARNING] SMTP Debugging is enabled (SMTP_DEBUG=true). Sensitive information could be disclosed via logs! [WARNING] Only enable SMTP_DEBUG during troubleshooting! ``` Do you see that message at all? If not, then it doesn't seem to be enabled at all.
Author
Owner

@juriansluiman commented on GitHub (Jan 12, 2022):

Yup, in the log:

 [WARNING] SMTP Debugging is enabled (SMTP_DEBUG=true). Sensitive information could be disclosed via logs!
 [WARNING] Only enable SMTP_DEBUG during troubleshooting!

/edit:
"smtp_debug": true is also in my support string from the admin page

@juriansluiman commented on GitHub (Jan 12, 2022): Yup, in the log: ```cmd [WARNING] SMTP Debugging is enabled (SMTP_DEBUG=true). Sensitive information could be disclosed via logs! [WARNING] Only enable SMTP_DEBUG during troubleshooting! ``` /edit: `"smtp_debug": true` is also in my support string from the admin page
Author
Owner

@BlackDex commented on GitHub (Jan 12, 2022):

That is really strange it should provide you some log-lines which start with/looks like the following:

[2022-01-12 14:00:31.605][lettre::transport::smtp::client::connection][DEBUG] Wrote: RCPT TO:<test5xx@domain.tld><CRLF> 
[2022-01-12 14:00:31.643][lettre::transport::smtp::client::connection][DEBUG] << 550 5.7.1 <test5xx@domain.tld>: Recipient address rejected: Testing 5xx messages<CRLF>
@BlackDex commented on GitHub (Jan 12, 2022): That is really strange it should provide you some log-lines which start with/looks like the following: ``` [2022-01-12 14:00:31.605][lettre::transport::smtp::client::connection][DEBUG] Wrote: RCPT TO:<test5xx@domain.tld><CRLF> [2022-01-12 14:00:31.643][lettre::transport::smtp::client::connection][DEBUG] << 550 5.7.1 <test5xx@domain.tld>: Recipient address rejected: Testing 5xx messages<CRLF> ```
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#1184