IBM Support

QRadar: Emails are not sent even if the email configuration is right and the test connection is successful

Question & Answer


Question

Why are emails not sent even though the email configuration is right and the test connection is successful?

Answer

In some cases, it is observed that email relay settings are correct and the test connection is also successful, but QRadar is still not able to send emails.

The following error can be seen in /var/log/maillog file, which indicates that the email delivery failed as the client does not have permissions to send as this sender:

Jun 15 09:03:49 Qradarhostname postfix/qmgr[4720]: 7EEDEC004EA: from=<QRADAR@localhost.localdomain>, size=24378, nrcpt=1 (queue active)
Jun 15 09:03:55 Qradarhostname postfix/smtp[120821]: 7EEZDE4EA: to=<abc@xyz.com>, relay=mail.xyz.com[XX.XX.XX.XX]:25, delay=5.6, delays=0.06/0.27/5.2/0.01, dsn=5.7.60, status=bounced (host mail.xyz.com[XX.XX.XX.XX] said: 550 5.7.60 SMTP; Client does not have permissions to send as this sender (in reply to end of DATA command))
Jun 15 09:03:55 Qradarhostname postfix/cleanup[120819]: 3A456C005CE: message-id=<20230605020355.3A456C005CE@Qradarhostname.xyz.com>
Jun 15 09:03:55 Qradarhostname postfix/bounce[121069]: 7EEZDE4EA: sender non-delivery notification: 3A456C005CE 

These errors are caused due to an incorrect value in the Alert Email From Address under Admin => System Settings.

image-20231218151554-1

To resolve these errors, perform following steps:

  1. On the QRadar GUI, go to Admin tab => System Settings => Alert Email From Address
  2. Correct the setting to reflect the email address that has permission to send emails (check with your email server's administrator for the correct email address)



 

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtKAAQ","label":"QRadar Risk and Vulnerability Manager"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
18 December 2023

UID

ibm17090394