Cannot send alert emails

[jljb]

It seems something has change with php/curl when using the email media types. It comes up with an error "Weird server reply" I have tested the email in thunderbird and outlook and it works fine using ssl/tsl ports 465 and 587.

Here is the error in the logs.

In send_email() smtp_server:'smtp.dynu.com' smtp_port:465 smtp_security:1 smtp_authentication:1
8188:20251219:100030.617 In handle_curl_error(): err:8
8188:20251219:100030.617 End of handle_curl_error(): error:Weird server reply
8188:20251219:100030.676 failed to send email: Weird server reply
8188:20251219:100030.676 End of send_email():FAIL
8188:20251219:100030.676 In zbx_ipc_socket_write()
8188:20251219:100030.677 End of zbx_ipc_socket_write():SUCCEED
8188:20251219:100030.677 End of alerter_process_email():FAIL
8188:20251219:100030.677 zbx_setproctitle() title:'alerter #2 [sent 0, failed 0 alerts, idle 111.494352 sec during 112.664538 sec]'
8188:20251219:100030.677 In zbx_ipc_socket_read()

[tim.mooney]

You don't tell us anything about your Zabbix server environment, which often is pretty important. It's possible dynu.com has upgraded to stricter TLS requirements recently and your environment isn't up to date to recognize the algorithms required by the remote end.

I don't use "dynu.com", but port 465 is conventionally SMTPSSL, e.g. the entire connection must have TLS/SSL from the start. That's different from port 25 (historical SMTP protocol) and port 587 (mail submission), because those ports typically must at least start without SSL/TLS, but usually offer encryption via STARTSSL. In those cases, the initial protocol exchange is cleartext, but may (sometimes must) then negotiate an upgrade to encrypted connection.

If dynu's port 465 does require SSL/TLS from the very start of the connection, make sure you're doing that, and not leaving it for later with STARTTLS.

If you're comfortable with network packet tracing, doing a packet capture and then analyzing it in something like wireshark may give you a strong clue about what is required by port 465 on the remote system.

If you're not comfortable with packet tracing, then the easier option is to install the 'telnet' binary on your Zabbix server and then do

telnet smtp.dynu.com 465

and see how it replies. If it outputs a readable text message, that means it's expecting the connection to start cleartext, not encrypted, so you need to make certain your Zabbix server isn't trying to force encryption at the start.

If it doesn't output a readable text message or it appears to output something binary, it means it is expecting TLS/SSL from the start, so you need to make certain your Zabbix server is forcing TLS as part of the initial connection.