Cannot send emails Linux command line to Google SMTP

you need to use an app password,(account/security)  and allow unsecure apps

Ok, so I turned on 2 factor authentication, added an app password.  I changed the config on my PC so the password matches the app password, ran the commands after to make the config and reload the service.  Still not working...

Just be aware, that no provider in the world will allow to relay email easily. 
So you have to be a customer and have to use the interfaces they have told you, because all other interfaces will be closed or limited. At the end you use a constructed email client and the settings are more or less the same than you would use for any other client as well. So I would rather espect, that you need port 25 with the smtp.gmail.com as long as google do not state something different.

The available server may be different, if you host an application on the same infrastructure. Than it is then an internal email and may need a different setting that for external emails.
The fact, that you can telnet a server does only mean,. the port is open, but does not mean that you are allowed to send mails over it.   

With Gmail, we can use 587 or 465 to send email.  They don't allow 25.

First item to remember is this only works with GSuite (paid) accounts now.

So, as @David Johnson mentioned, you'll use the user/pass used in your GSuite account.

If you don't use GSuite, switch to a Mail Relay service like https://smtp2go.com or similar.

Suggestion: Use SWAKS first, to verify all is well with your authentication.

Example, using https://smtp2go.com as the relay service...

swaks -s mail.smtp2go.com:587 -tlsp tlsv1_2 -auth -au $user -ap $pass --from=$from --header "Subject: Test Message CDT 2021" --to=$to

Select allOpen in new window

Mail uses /usr/sbin/sendmail which is a symlink to whatever your MTA is
This means depending on which mta you gave installed, has to be configured in the relay/transport rules using an app password

Domain.com
Or
* username@somedomain.com:app_password@smtp-relay.gmail.com:587

This line varies among the Mta's.

Well, I am a paying gsuite user.  I pay for the gsuite workspaces same as a business would.  So, it would be nice to keep the solution inclusive to gmail and not use a different relay server.

If I telnet smtp.gmail.com on port 465, I get a hello response....
If I telnet smtp.gmail.com on port 587, I get a resonse, but no hello

You said you can not telnet this address what would lead me to a firewall issue?

I will not exclude, that smtp-relay.gmail.com doesn't work on the one or other port, but at least from the infrastructures I have seen in the past, a dedicated smtp relay server was always used for other special purposes, but not regular customer traffic.

Ok, let's start from the begining so we have all the ducks in the row before ...
mail is an email client application on Linux that is designed to inject the message being sent into the locla server, mta sendmail, postfix, etc. based on what you have installed. For this reason, /usr/sbin/sendmail is the placeholder that mail uses while it is a backwards handler of most MTA's that might be installed on the system.
In this case, you rely on the local MTa configuration as to the next delivery point of the message to the next system.
In your case, you want it going through gmail/Gsuite thus the requirement to configure your Linux MTA as a relay client to the Gsuit/gmail outgoing server setting.

Once you setup the MTA to relay through gmail's Gsuit your use of mail -s will get the message flow through.

To get the email client on Linux to actually perform an SMTP transaction with gmail Gsuit servers, you have to find the email client capable of that.

Often, you would need to configure a .mailrc or the respective email client name rc file.

If it is capable of ..

You mentioned, "Well, I am a paying gsuite user", so this should be straightforward.

Run the SWAKS command above with your GSuite provided credentials.

Once you've verified all's well in SWAKS, transfer the settings to your MTA config.

So long as you send under the Google rate limits this will work.

If you exceed the Google rate limits, switch out your sending to a Relay Service.

The swaks connects without issue

r "Subject: Test Message CDT 2021" --to=david@nerdtechdad.com
=== Trying smtp-relay.gmail.com:587...
=== Connected to smtp-relay.gmail.com.
<-  220 smtp-relay.gmail.com ESMTP s24sm381101pjn.6 - gsmtp
 -> EHLO david-MS-7B51
<-  250-smtp-relay.gmail.com at your service, [71.9.176.203]
<-  250-SIZE 157286400
<-  250-8BITMIME
<-  250-STARTTLS
<-  250-ENHANCEDSTATUSCODES
<-  250-PIPELINING
<-  250-CHUNKING
<-  250 SMTPUTF8
*** Host did not advertise authentication
 -> QUIT
<-  221 2.0.0 closing connection s24sm381101pjn.6 - gsmtp
=== Connection closed with remote host.

Ok, so when I was running the test in my first post's link, I was getting the long pause.  I kept on skipping over the spot where it said if there's a long pause to make sure I have a fqdn for my hostname.  So, I just changed it and now when I run the test, it runs quick.  But the emails are still not sending.

Here's my mail log

May 17 20:25:39 david-MS-7B51 sm-mta[478322]: restarting /usr/sbin/sendmail-mta due to signal
May 17 20:25:39 david-MS-7B51 sm-mta[478621]: starting daemon (8.15.2): SMTP+queueing@00:10:00
May 17 20:25:39 david-MS-7B51 sm-mta[478622]: 14I1OCY5478506: to=<david@localhost.localdomain>, delay=00:01:27, xdelay=00:00:00, mailer=local, pri=120000, dsn=2.0.0, stat=Sent
May 17 20:25:39 david-MS-7B51 sm-mta[478622]: 14I1Muhp478472: to=<david@localhost.localdomain>, delay=00:02:43, xdelay=00:00:00, mailer=local, pri=120000, dsn=2.0.0, stat=Sent
May 17 20:25:54 david-MS-7B51 sendmail[478646]: 14I1PsCh478646: from=david@localhost.localdomain, size=131, class=0, nrcpts=1, msgid=<202105180125.14I1PsCh478646@localhost.localdomain>, relay=david@localhost
May 17 20:25:54 david-MS-7B51 sm-mta[478647]: 14I1Psjj478647: from=<david@localhost.localdomain>, size=415, class=0, nrcpts=1, msgid=<202105180125.14I1PsCh478646@localhost.localdomain>, proto=ESMTP, daemon=MTA-v4, relay=localhost.localdomain [127.0.0.1]
May 17 20:25:54 david-MS-7B51 sendmail[478646]: 14I1PsCh478646: to=<david@nerdtechdad.com>, ctladdr=david@localhost.localdomain (1000/1000), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30131, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (14I1Psjj478647 Message accepted for delivery)
May 17 20:25:55 david-MS-7B51 sm-mta[478649]: STARTTLS=client, relay=smtp-relay.gmail.com., version=TLSv1.3, verify=FAIL, cipher=TLS_AES_256_GCM_SHA384, bits=256/256
May 17 20:25:55 david-MS-7B51 sm-mta[478649]: 14I1Psjj478647: to=<david@nerdtechdad.com>, ctladdr=<david@localhost.localdomain> (1000/1000), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120415, relay=smtp-relay.gmail.com. [74.125.21.28], dsn=5.0.0, stat=Service unavailable
May 17 20:25:55 david-MS-7B51 sm-mta[478649]: 14I1Psjj478647: 14I1Ptjj478649: DSN: Service unavailable
May 17 20:25:55 david-MS-7B51 sm-mta[478649]: 14I1Ptjj478649: to=<david@localhost.localdomain>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent
May 17 20:32:03 david-MS-7B51 sendmail[478914]: 14I1Vwm1478914: from=david@localhost.localdomain, size=131, class=0, nrcpts=1, msgid=<202105180131.14I1Vwm1478914@localhost.localdomain>, relay=david@localhost
May 17 20:32:03 david-MS-7B51 sm-mta[478919]: 14I1W3lx478919: from=<david@localhost.localdomain>, size=415, class=0, nrcpts=1, msgid=<202105180131.14I1Vwm1478914@localhost.localdomain>, proto=ESMTP, daemon=MTA-v4, relay=localhost.localdomain [127.0.0.1]
May 17 20:32:03 david-MS-7B51 sendmail[478914]: 14I1Vwm1478914: to=<david@nerdtechdad.com>, ctladdr=david@localhost.localdomain (1000/1000), delay=00:00:05, xdelay=00:00:00, mailer=relay, pri=30131, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (14I1W3lx478919 Message accepted for delivery)
May 17 20:32:04 david-MS-7B51 sm-mta[478921]: STARTTLS=client, relay=smtp-relay.gmail.com., version=TLSv1.3, verify=FAIL, cipher=TLS_AES_256_GCM_SHA384, bits=256/256
May 17 20:32:04 david-MS-7B51 sm-mta[478921]: 14I1W3lx478919: to=<david@nerdtechdad.com>, ctladdr=<david@localhost.localdomain> (1000/1000), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120415, relay=smtp-relay.gmail.com. [74.125.138.28], dsn=5.0.0, stat=Service unavailable
May 17 20:32:04 david-MS-7B51 sm-mta[478921]: 14I1W3lx478919: 14I1W4lx478921: DSN: Service unavailable
May 17 20:32:04 david-MS-7B51 sm-mta[478921]: 14I1W4lx478921: to=<david@localhost.localdomain>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent
May 17 20:32:48 david-MS-7B51 sendmail[478932]: 14I1WmtH478932: from=david@localhost.localdomain, size=131, class=0, nrcpts=1, msgid=<202105180132.14I1WmtH478932@localhost.localdomain>, relay=david@localhost
May 17 20:32:48 david-MS-7B51 sm-mta[478933]: 14I1Wm91478933: from=<david@localhost.localdomain>, size=415, class=0, nrcpts=1, msgid=<202105180132.14I1WmtH478932@localhost.localdomain>, proto=ESMTP, daemon=MTA-v4, relay=localhost.localdomain [127.0.0.1]
May 17 20:32:48 david-MS-7B51 sendmail[478932]: 14I1WmtH478932: to=<david@nerdtechdad.com>, ctladdr=david@localhost.localdomain (1000/1000), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30131, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (14I1Wm91478933 Message accepted for delivery)
May 17 20:32:49 david-MS-7B51 sm-mta[478935]: STARTTLS=client, relay=smtp-relay.gmail.com., version=TLSv1.3, verify=FAIL, cipher=TLS_AES_256_GCM_SHA384, bits=256/256
May 17 20:32:49 david-MS-7B51 sm-mta[478935]: 14I1Wm91478933: to=<david@nerdtechdad.com>, ctladdr=<david@localhost.localdomain> (1000/1000), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120415, relay=smtp-relay.gmail.com. [74.125.138.28], dsn=5.0.0, stat=Service unavailable
May 17 20:32:49 david-MS-7B51 sm-mta[478935]: 14I1Wm91478933: 14I1Wn91478935: DSN: Service unavailable
May 17 20:32:49 david-MS-7B51 sm-mta[478935]: 14I1Wn91478935: to=<david@localhost.localdomain>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30000, dsn=2.0.0, stat=Sent

May 17 20:32:49 david-MS-7B51 sm-mta[478935]: 14I1Wm91478933: 14I1Wn91478935: DSN: Service unavailable
May 17 20:32:49 david-MS-7B51 sm-mta[478935]: 14I1Wn91478935: to=<david@localhost.localdomain>, you changed this right?

what  are the settings you are using now?

google help docs https://support.google.com/a/answer/176600?hl=en

Here's my gmail auth file..

AuthInfo: "U:root" "I:david@mxhubspot.com" "P:mypassword"

Select allOpen in new window

this is my sendmail.mc (the end of the file)

define(`SMART_HOST',`[smtp-relay.gmail.com]')dnl
define(`RELAY_MAILER_ARGS', `TCP $h 587')dnl
define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
FEATURE(`authinfo',`hash -o /etc/mail/authinfo/gmail-auth.db')dnl


MAILER_DEFINITIONS
MAILER(`local')dnl
MAILER(`smtp')dnl

Select allOpen in new window

Below are my Google settings.

are you using sendmail ?
not sure about this line
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

1) This diagnostic suggests something is failing inside Gmail...

*** Host did not advertise authentication

Select allOpen in new window

So the initial connection picked up + likely what was missing in your swaks command was an argument to force a TLS connection.

Provide your actual swaks command for debugging.

What you should see here is the AUTH part of the SMTP conversation.

2) Since you're using sendmail (shudder...) you'll have to extend your sendmail config file to force TLS sending.

https://cromwell-intl.com/open-source/sendmail-ssl.html is one guide you might find useful for this.

Ok, so I think I got it figured out.  

FYI, this is a script to control the electronics in our house.  Our kids got clever and figured out how to default a phone getting around any monitoring I put in place.  So, I setup a process now on their phones that is constantly writing a file to my Dropbox.  This file then syncs down to my PC which is where the script is running.  I'm checking that file for the last modified time.  If the last modified time goes above a certain threshold, that tells me they might be up to something.  So, it sends me an email stating hasn't gotten an update in 10 minutes or whatever.

I need to get better at my shell scripting.  It's been a while since I've messed around with the shell.  (Been living in a Windows world for many years.)



Thank you everyone for your help.

Command looks good.

As an experiment, remove the -tls as the -tlsp option already handles this.

If you supply -tls in addition to -tlsp the TLS protocol might downgrade to TLSv1.0 which would be a protocol error with Gmail, causing the connection to die, as you're seeing.

Try this + see if problem clears.

Just tested this myself + my guess was correct.

If you supply both -tlsp + -tls, the -tls downgrades whatever -tlsp protocol is passed.

So just remove the -tls, test again, report whether problem cleared or persists.

I'd thought this was a SWAKS bug + I was running an old version on the machine where I was testing.

Latest SWAKS (swaks-2020-10-14) produces this error...

imac> swaks -s mail.smtp2go.com:587 -tlsp tlsv1_2 -auth -au $user -ap $pass --from=david@davidfavor.com --to=david@davidfavor.com -tls
*** tlsv1_2 in --tls-protocol is not a known/supported protocol
*** no valid arguments provided to --tls-protocol, exiting

Select allOpen in new window

So make sure you have the latest version of SWAKS running on your machine.

Could you post what helped you resolve the issue; thus, could help others running into a similar situation.

As @arnold mentioned, post how you resolved this.