Issue gmx.* (web.de etc.) POP3 collector service fails to access Plesk based mail server

[Bitpalast]

For a few months we are getting complaints from customers who are using the GMX POP3 collector service to collect mails from Plesk based mailboxes that suddenly their GMX account can not connect to the mail servers here any longer.

We first suspected IP bans, but could rule that out. We are seeing this log entry for every attempt that the GMX pop3 collector mail servers do:

Mar 10 16:45:27 <host shortname> dovecot: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 (no auth attempts in 0 secs): user=<>, rip=87.106.202.13, lip=<local ip>, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<UrxtGt/ZXbpXasoN>

All other mail clients of all customers have no issues to connect to Dovecot using IMAP, IMAPS, POP3 or POP3S protocols and ports. We think that "tlsv1 alert unknown ca: SSL alert number 48" is the key line in the error message, but we don't see why this problem exists. As always, GMX is problematic when it comes to support.

Can anyone enlighten me please so that we can work around this issue?

 

[fliegerhermi]

Hi Peter. Do you have a solution to this?
I am having problem with outgoing spam, but it is hard to tell users to avoid forwarding to GMX, when the pop3 collection doesn't work.
Thanks

EDIT: Is it possible, that gmx doesn't accept letsencrypt certs? Has it been tested on plesk with regular certs?

 

[Bitpalast]

Sorry, I do not have a solution for you.

I can only say that GMX just as what some other United Internet brands are well known for are doing an atrocious job when it comes to support. We did inquire on this issue and their response was like "Please don't ask again". For me it is quite obvious that they have a severe issue with their systems but "as always" are hiding their head in the sand. How can a brand like GMX respond with a "Please don't ask again" when you tell them that their systems can't connect to millions of servers globally while other mail providers can? Should they not be interested in researching and healing the cause? They are just a big disappointment, and your best option is to tell your users to leave them and run their mailboxes directly on their own domain.