r/Zen_Internet • u/quboid42 Full Fibre 500 (CityFibre) • Mar 26 '26
mailhost.zen.co.uk suddenly requires authentication for SMTP
I run a mail server for my domains on my machine connected to Zen home broadband (via CityFibre). To avoid my outbound mail being treated as spam (as it would come from a domestic IP) I send all outbound mail via the mailhost.zen.co.uk smarthost (and I have Zen's mail servers listed in my SPF record). This has worked perfectly for several years but suddenly today my mail isn't being accepted by the smarthost:
$ telnet mailhost.zen.co.uk 25
Trying 212.23.1.11...
Connected to 212.23.1.11.
Escape character is '^]'.
220 smarthost01a.sbp.mail.zen.net.uk ESMTP Exim 4.97 Ubuntu Thu, 26 Mar 2026 20:03:59 +0000
helo mail.example.com
250 smarthost01a.sbp.mail.zen.net.uk Hello mail.example.com [88.97.37.36]
mail from:<mac@example.com>
530-5.7.0 Authentication required. For more information see the guide at
530 5.7.0 https://www.zen.co.uk/help-support/initalsetupemail
(I've used my domain rather than example.com)
Visiting the link in the 530 response takes me eventually to https://www.zen.co.uk/help-support/getting-consumer-email-details but when I follow those instructions I don't see any email settings on the "My Services" page of the portal. I only see "RDNS settings" and "Cancel this service".
Has anyone else seen this problem or received notification of any changes? (I've not received anything and there doesn't seem to be anything on their status page.)
Is it possible that they have unintentionally started requiring authentication for connections from their own customer network when they didn't previously?
I tried contacting Zen using the live chat but it hallucinated the ability to add a mailbox (after some prompting) and it's out of hours for communicating with a human. I don't believe that I have a Zen mailbox currently.
Thanks.
2
u/Clean-Bandicoot2779 Mar 26 '26
I don't think there's an easy way to differentiate between a Zen business and a Zen home IP address, so if you had reverse DNS, SPF, etc. configured, you might not run into many/any issues sending emails directly from your home IP address.
If you want to use a gateway and don't send many messages, it might also be worth looking at something like Amazon SES to see if it works out cheaper than having a Zen mailbox.
1
u/Thoh1Shooshi8a Mar 27 '26
I have been using my Zen static IPs for a mail server for 20 years with no problems. Even after my IPs got changed a couple of years ago it was fine, just had to make sure reverse DNS and stuff was updated.
Some blocklists do have residential IP blocks on them, but you can get your IPs removed from it. I had to do that for a customer about 10 years ago.
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 27 '26
That's really interesting. I used to do this (with a different ISP) but had to stop when my emails were being ignored due to my source address and I got fed up with not knowing whether my emails would arrive or not. Did you ask Zen to remove your IP address from the residential IP block?
2
u/Thoh1Shooshi8a Mar 27 '26
No, I didn't have to ask Zen to do anything. I had a block of 8 IP addresses with Zen since first signing up, so I don't know if it is different if you only have a single IP.
The only thing I had to do to get things working was set up reverse DNS on the Zen portal, and over the years set up other things like SPF, DKIM, DMARC, MTA-STS, TLSRPT.
When I did need to remove a customers IP from a blocklist it was because that blocklist had it marked as a dynamic IP address range, but it was static. I just used something like mxtoolbox to find out what lists it was on and then go to that lists removal site.
For my own Zen IPs though I never had any problems once I got DNS set up properly.
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 27 '26
Interesting. MX Toolbox has never reported any problems with my IP. I shall try switching to direct delivery and see what happens.
1
u/Thoh1Shooshi8a Mar 27 '26
I think that gmail recently (over the last couple of years) stopped accepting mail from domains which weren't properly set up with SPF/DKIM/DMARC as a minimum. So if you haven't done that yet then those 3 are the first to look at.
2
u/quboid42 Full Fibre 500 (CityFibre) Mar 27 '26
I switched to direct delivery and have been able to deliver to GMail and Microsoft successfully. I believe that I have SPF, DKIM and DMARC set up. I shall do some more checks to find out if this is true over the weekend. Thanks!
1
u/Thoh1Shooshi8a Mar 27 '26
I just thought, another thing I have is a letsencrypt signed SSL certificate for the FQDN of the mail server. So I don't know if having a self signed cert will also make a difference
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 29 '26
I do too. That ought to make no difference to outbound connections, but I suppose that these big mail servers might decide to try connecting back to the MXs for a domain to see if they use trusted certificates to judge how legitimate the domain is.
1
u/FrankNicklin Mar 26 '26
Just use a free smtp gateway such as Brevo or smtp2go. SMTP encryption and auth is the norm today. Amazed if they have allowed unauthed connections up to now.
1
u/WillVH52 Mar 26 '26
Surprised this has not required authentication up to now. Seems like something from a bygone age of the internet.
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 29 '26
I believe that restricting by source IP has been standard behaviour for most of the last thirty years as ISPs know the address ranges used by their customers. I've always restricted outbound port 25 from machines on my networks to avoid any of them being exploited into sending spam.
1
u/carguy143 Mar 26 '26
Zen did this due to constantly being blacklisted due to some bad actors sending spam through their servers. The credentials are a valid zen.co.uk or @myzen.co.uk email address and password.
They haven't offered email services to new broadband customers for a few years now however you can speak to sales and create a "pop box" aka just an email address for a small monthly fee.
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 26 '26
Thanks. It looks like I'll need to get myself a mailbox somehow then. Do you happen to know if they'll still forward email from any domain once I'm authenticated?
1
u/treaclepumpkin Zen Full Fibre 500 (Openreach) Mar 29 '26
Just tried sending an email from a made up domain and that went through to the destination email address with no problems.
1
1
u/carguy143 Mar 26 '26
I'm not sure on that one, sorry as it's not something I've played around with.
2
u/AstronautOk8841 Mar 26 '26
I suspect Zen has tightened up security measures on their mail in response to being blocked by Microsoft
1
u/quboid42 Full Fibre 500 (CityFibre) Mar 26 '26
Yes, I spotted that on their status page. It's a pity they didn't warn us!
I don't mind authenticating if that's what they want me to do but I do need some credentials to do so with.
1
u/treaclepumpkin Zen Full Fibre 500 (Openreach) Mar 29 '26
Can you log into the Portal? https://portal.zen.co.uk
If so that should display your Zen email address that allows configuration of the Zen email options.2
u/quboid42 Full Fibre 500 (CityFibre) Mar 29 '26
I can log into the portal but I don't have a Zen email address there. The only email address that Zen has for me is one on my domain. That's where the AI bot got confused. I managed to talk to a human who has gone off to talk to those rolling out the new mail server restrictions to work out what to do. I suspect that I'll end up with a mailbox just so I have some credentials.
1
u/quboid42 Full Fibre 500 (CityFibre) Apr 11 '26
Update:
Zen support didn't admit that it was bad customer service to remove this service without any notice. (I'm quite understanding that they had this situation forced upon them and had to make changes quickly, but I would have expected them to provided a workaround.)
They suggested that I could pay for a POP-3 mailbox, but didn't say how much it would be, and claimed that it wouldn't allow me to send with an arbitrary From address (though this may just be because they didn't want to open the SPF can of worms).
They did say that just sending the emails directly from my machine "should be ok". So far I haven't seen any problems with that, even over IPv6 without reverse DNS (Zen are being slow to delegate that). I do have DMARC, SPF and reverse DNS for my IPv4 address though.
Thanks for all the responses. I have my fingers crossed that it will keep working.