# \[Watcher\] 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

**URL:** <https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 30, 2020, 11:28am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806 "2020-10-30T11:28:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [October 30, 2020, 11:28am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806/1 "2020-10-30T11:28:10Z")

</div>

When running watcher with email action, we are getting this error :  
550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

We use a corporate SMTP server, elasticsearch.yml config looks like this

```
xpack.notification.email.account:
    smtp_account:
        profile: standard
        email_defaults:
            from: support@corporate.co
        smtp:
            auth: false
            starttls.enable: false
            host: mail.corporate.co
            port: 587
            user: support@corporate.co

```

The action work when using a gmail account, but when using our corporate email we get this error. Does anybody had this issue in the past ?

Here is the verbose when sending a telnet to the SMTP server

```
220-hostXX.corporate.co ESMTP Exim 4.93 #2 Fri, 30 Oct 2020 12:24:21 +0100
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
HELO corporate.co
250 hostXX.corporate.co Hello corporate.co [xx.xx.xx.xx]
HELP
214-Commands supported:
214 AUTH STARTTLS HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 2, 2020, 3:29am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806/2 "2020-11-02T03:29:12Z")

</div>

Can you try adding this:

```auto
xpack.notification.email.account:
    smtp_account:
        smtp:
            local_address: corporate.co

```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 2, 2020, 12:02pm UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806/3 "2020-11-02T12:02:15Z")

</div>

Thanks @TimV  
I am getting this new error

```
[2020-11-02T12:55:26,851][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [node01] failed to execute action [_inlined_/email_1]
java.security.AccessControlException: access denied ("java.net.SocketPermission" "localhost:0" "listen,resolve")
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?] 

```

I added this

```
xpack.notification.email.account:
    smtp_account:
        smtp:
            local_address: corporate.co
            local_port: 587

```

I got this error

```
[2020-11-02T12:55:26,851][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [node01] failed to execute action [_inlined_/email_1]
java.security.AccessControlException: access denied ("java.net.SocketPermission" "localhost:587" "listen,resolve")
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?]
```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 3, 2020, 1:32am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806/4 "2020-11-03T01:32:10Z")

</div>

I don't think there's any solution here, I'm afraid.

As best I can tell the problem is that your corporate SMTP server doesn't want to accept email from the domain that your Elasticsearch host runs on.

I had hoped that you could configure your way around that, but that's not working.

I think your next best option is to talk to your mail admins about why their rejecting mail from your hosts.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2020, 1:32am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806/5 "2020-12-01T01:32:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.