I posted this on askubuntu.com yesterday but haven't gotten any responses.

We run a production Ubuntu server that serves thousands of people per day. Sendmail is currently not working on this server. We've spent days trying to get it back up but we haven't found any solution yet.

There's currently a bug report that appears to be related to this problem, so it affects more people than just us.

Here's what we know.

On Sunday we ran updates on the server. The next day we found that sendmail was failing to send emails.

/var/log/sendmail.log reports "stat=Deferred" on every email entry.

It also occasionally repeats the following message:

STARTTLS=client, error:connect failed=-1, SSL_error=1, errno=0, retry=-1
STARTTLS=client: 7042:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3338:ruleset=tls_server, arg1=SOFTWARE, relay=xxx.xxx.edu, reject=403 4.7.0 TLS handshake failed.

We checked the logs on the SMTP server and found the following:

06-25T10:57:20-06:00 gw26 sm-mta[17229]: STARTTLS=server, error: accept failed=0, SSL_error=1, errno=0, retry=-1
No explanation available 2015-06-25T10:57:20-06:00 gw26 sm-mta[17229]: STARTTLS=server: 17229:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1110:SSL alert number 40
Explain this log line 2015-06-25T10:57:20-06:00 gw26 sm-mta[17229]: t5PGvKk0017229: opus.byu.edu [] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

We have spent much time Googling around and have found several people with related problems on other operating systems (CentOS and OpenBSD). It appears that OpenSSL has been updated and now requires a longer SSL key to function properly.

This bug on launchpad page may be related.

We have attempted to fix the problem by following the CentOS instructions given here. NOTE: We changed the location of the new dhparams.pem file.

Generate DH parameters file on your server:

openssl dhparam -out /etc/pki/tls/certs/dhparams.pem 1024 Configure
sendmail to use this parameters file, and to use only strong ciphers.

Add to /etc/mail/sendmail.mc:

O DHParameters=/etc/pki/tls/certs/dhparams.pem 
O ServerSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3

Then use make -C /etc/mail/ and service sendmail restart.

This did not appear to improve anything in any way.


We turned off TLS by doing the following and sendmail instantly began functioning again. However, this isn't a solution, because we don't want to send plaintext emails.

Add Try_TLS: NO to /etc/mail/access.
Do a make in /etc/mail and restart sendmail.


The procedure of adding a dhparams file and pointing sendmail at it worked for me. I was getting the "dh keys too small" on a recently updated sendmail client, and it was the server it was sending to that needed the dhparams fix applied. Forunately in my case, the server was under my own control.

I'm a bit concerned that sites that are getting these errors will have to turn off TLS as you have (or revert the openssl update). This is definitely not in the spirit of what they were trying to do (make DH stronger)!

  • The server, huh? That's rough. Updating our box forces the remote server to change in order to maintain compatibility since their dh key is (apparently) too small. We'll have to put in a request. – Benjamin Jun 28 '15 at 2:40

In a new NSS library set a minimum key lengths:

  • The minimum modulus size for RSA keys is now 512 bits
  • The minimum modulus size for DSA keys is now 1023 bits
  • The minimum modulus size for Diffie-Hellman keys is now 1023 bits

It is very important that the number of bits is not less than 2048 bits. 2048 was chosen to improve security in the case of DH.

openssl dhparam -out /etc/pki/tls/certs/dhparams.pem 2048

Also disable all ADH chipers in senmail.mc:


 O CipherList=HIGH:!ADH

 O DHParameters=/etc/pki/tls/certs/dhparams.pem
  • Don't post code without any explanation about why and how it helps. – guntbert Jul 22 '15 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.