Slow Outbound Email

[mjsengineer]

I'm using Thunderbird to connect to an email server outside of my network. I'm connecting to mail.outsideserver.com on port 587.

The connection is made and the email gets sent, but it takes a while. I checked with the admins of the outside server and the issue appears to be on my side.

This didn't happen when I set up Pfsense on a SG-3100 device.
I must have unknowingly changed something.

Beyond the basic configuration, I've added Snort, ntopng and pftop.

ideas?

[johnpoz]

@mjsengineer said in Slow Outbound Email:

The connection is made and the email gets sent, but it takes a while

Which means what exactly... Your sending 1000 emails at a time and it takes X minutes... Your sending 1 email that says hey bob and it takes 30 seconds? Your emailing out photos from the company party and the emails are 100MB each?

Or you send the email in 10 seconds, and then they don't get delivered for 20 minutes?

Is snort reporting any issues, do you have it in monitor mode or blocking mode?

Do your other uploads and downloads work fine?

[mjsengineer]

Fair enough. A bit vague:

I write a test email with nothing but "Test" in the subjectt.
I click send in thunderbird & it displays a status message saying
"Connected to mail.outsideserver.com"

It then sits on the "sending email" status bar for 32 seconds or
so before it is declared to have been sent.

It seems rather sluggish for a nearly empty message.

I haven't observed any slow behavior in any other network activity.

[johnpoz]

@mjsengineer said in Slow Outbound Email:

appears to be on my side.

Means what - what did they actually?

So what I would do is sniff the traffic and see what is going on.. Pfsense is not going to block anything, and even it if did... It would NEVER work!! if snort was blocking of you sending email - it would log it for one, and then your email would just fail..

So what I would ask them what they mean by appears to be on your side?

[KOM]

@mjsengineer said in Slow Outbound Email:

I checked with the admins of the outside server and the issue appears to be on my side.

How so, specifically? Did they provide you with any logs or metrics to back that up, or did they just punt the ball back to you? In the five years I've been here, I've never heard of a case where everything is fine but sending mail is slow. Packets are packets. pfSense can't tell the difference between an email data packet vs http.

Packages can be another matter and any time weird stuff starts happening that wasn't happening before, I always disable any packages that I suspect may be causing the issue.

Answer John's questions about symptoms and we can dig deeper.

[JKnott]

You can watch the traffic with Wireshark to get a clue. Also, if in doubt, remove pfSense from the equation. Do you have a cheap router you can drop in it's place?