starred/mailpit

Fork 0

mirror of https://github.com/axllent/mailpit.git synced 2026-04-26 16:56:00 +03:00

[GH-ISSUE #553] Specifying SMTP credentials in MP_SMTP_AUTH env variable not working #357

New issue

Closed

opened 2026-03-15 14:03:51 +03:00 by kerem · 4 comments

kerem commented

2026-03-15 14:03:51 +03:00

Owner

Originally created by @zam6ak on GitHub (Aug 16, 2025).
Original GitHub issue: https://github.com/axllent/mailpit/issues/553

I am running latest Mailpit v1.27.4 in a Docker container and am trying to specify SMTP credentials via environment variable.

However, no matter what combination I try (plaintext, crypt-SHA512) I am getting DENY message in the log...

Here is the compose section for my Mailpit container

    mailpit:
        image: axllent/mailpit:v1.27.4
        restart: always
        environment:
            - MP_VERBOSE=true
            - TZ=US/Eastern
            - MP_UI_TLS_KEY=/certs/cert.pem.key
            - MP_UI_TLS_CERT=/certs/cert.pem
            - MP_SMTP_BIND_ADDR=:587
            - MP_SMTP_TLS_KEY=sans:localhost
            - MP_SMTP_TLS_CERT=sans:localhost
            - MP_SMTP_REQUIRE_STARTTLS=true
            - MP_SMTP_AUTH='user1:password1'
        ports:
            - "8025:8025/tcp"
            - "587:587/tcp"
        volumes:
            - "./cfg/cert.pem:/certs/cert.pem:ro"
            - "./cfg/cert.pem.key:/certs/cert.pem.key:ro"

Here is how I tested (making a cURL call from my PC (host)

cURL command:

curl \
        -v --insecure --silent --show-error \
                --ssl-reqd \
                --url "smtp://host.docker.internal:587" \
                --user "user1:password1" \
                --mail-from "sender@testing.org" \
                --mail-rcpt "test_user@testing.org" \
                --upload-file - <<-EMAIL
        From: sender@testing.org
        To: test_user@testing.org
        Subject: 1)  Simple test email - from host to smtp://host.docker.internal:587

        This message was generated on: $(date)
EMAIL

cURL log:

* Host host.docker.internal:587 was resolved.
* IPv6: (none)
* IPv4: 192.168.7.209
*   Trying 192.168.7.209:587...
* Connected to host.docker.internal (192.168.7.209) port 587
< 220 2a408247117c Mailpit ESMTP Service ready
> EHLO devpc06
< 250-2a408247117c greets devpc06
< 250-SIZE 0
< 250-STARTTLS
< 250-AUTH LOGIN PLAIN
< 250-ENHANCEDSTATUSCODES
< 250 SMTPUTF8
> STARTTLS
< 220 2.0.0 Ready to start TLS
* schannel: disabled automatic use of client certificate
* Connected to host.docker.internal (192.168.7.209) port 587
> EHLO devpc06
< 250-2a408247117c greets devpc06
< 250-SIZE 0
< 250-AUTH LOGIN PLAIN
< 250-ENHANCEDSTATUSCODES
< 250 SMTPUTF8
> AUTH PLAIN
< 334
> AHVzZXIxAHBhc3N3b3JkMQ==
< 535 5.7.8 Authentication credentials invalid
* closing connection #0
curl: (67) Login denied

And here is SMTP log from Mailpit

mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 220 2a408247117c Mailpit ESMTP Service ready"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) EHLO devpc06"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 250-2a408247117c greets devpc06\r\n250-SIZE 0\r\n250-STARTTLS\r\n250-AUTH PLAIN LOGIN\r\n250-ENHANCEDSTATUSCODES\r\n250 SMTPUTF8"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) STARTTLS"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 220 2.0.0 Ready to start TLS"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) EHLO devpc06"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 250-2a408247117c greets devpc06\r\n250-SIZE 0\r\n250-AUTH LOGIN PLAIN\r\n250-ENHANCEDSTATUSCODES\r\n250 SMTPUTF8"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) AUTH PLAIN"
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 334 "
mailpit-1  | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) AHVzZXIxAHBhc3N3b3JkMQ=="
mailpit-1  | time="2025/08/16 13:52:12" level=warning msg="[smtpd] deny PLAIN login:\"user1\" from:10.4.99.1"
mailpit-1  | time="2025/08/16 13:52:12" level=error msg="[smtpd] response (10.4.99.1) 535 5.7.8 Authentication credentials invalid"

If I replace MP_SMTP_AUTH='user1:password1' and specify MP_SMTP_AUTH_ACCEPT_ANY=true everything works fine...
I also tried MP_SMTP_AUTH='user1:<crypt-sha512-hash-of-password1>' instead of plain password but that did not work either...

Are my settings incorrect, or could this be some other issue?

Thanks
Z....

Originally created by @zam6ak on GitHub (Aug 16, 2025). Original GitHub issue: https://github.com/axllent/mailpit/issues/553 Hi I am running latest Mailpit v1.27.4 in a Docker container and am trying to [specify SMTP credentials via environment variable](https://mailpit.axllent.org/docs/configuration/smtp/#passwords-via-environment). However, no matter what combination I try (plaintext, crypt-SHA512) I am getting `DENY` message in the log... Here is the compose section for my Mailpit container ``` mailpit: image: axllent/mailpit:v1.27.4 restart: always environment: - MP_VERBOSE=true - TZ=US/Eastern - MP_UI_TLS_KEY=/certs/cert.pem.key - MP_UI_TLS_CERT=/certs/cert.pem - MP_SMTP_BIND_ADDR=:587 - MP_SMTP_TLS_KEY=sans:localhost - MP_SMTP_TLS_CERT=sans:localhost - MP_SMTP_REQUIRE_STARTTLS=true - MP_SMTP_AUTH='user1:password1' ports: - "8025:8025/tcp" - "587:587/tcp" volumes: - "./cfg/cert.pem:/certs/cert.pem:ro" - "./cfg/cert.pem.key:/certs/cert.pem.key:ro" ``` Here is how I tested (making a cURL call from my PC (host) cURL command: ``` curl \ -v --insecure --silent --show-error \ --ssl-reqd \ --url "smtp://host.docker.internal:587" \ --user "user1:password1" \ --mail-from "sender@testing.org" \ --mail-rcpt "test_user@testing.org" \ --upload-file - <<-EMAIL From: sender@testing.org To: test_user@testing.org Subject: 1) Simple test email - from host to smtp://host.docker.internal:587 This message was generated on: $(date) EMAIL ``` cURL log: ``` * Host host.docker.internal:587 was resolved. * IPv6: (none) * IPv4: 192.168.7.209 * Trying 192.168.7.209:587... * Connected to host.docker.internal (192.168.7.209) port 587 < 220 2a408247117c Mailpit ESMTP Service ready > EHLO devpc06 < 250-2a408247117c greets devpc06 < 250-SIZE 0 < 250-STARTTLS < 250-AUTH LOGIN PLAIN < 250-ENHANCEDSTATUSCODES < 250 SMTPUTF8 > STARTTLS < 220 2.0.0 Ready to start TLS * schannel: disabled automatic use of client certificate * Connected to host.docker.internal (192.168.7.209) port 587 > EHLO devpc06 < 250-2a408247117c greets devpc06 < 250-SIZE 0 < 250-AUTH LOGIN PLAIN < 250-ENHANCEDSTATUSCODES < 250 SMTPUTF8 > AUTH PLAIN < 334 > AHVzZXIxAHBhc3N3b3JkMQ== < 535 5.7.8 Authentication credentials invalid * closing connection #0 curl: (67) Login denied ``` And here is SMTP log from Mailpit ``` mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 220 2a408247117c Mailpit ESMTP Service ready" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) EHLO devpc06" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 250-2a408247117c greets devpc06\r\n250-SIZE 0\r\n250-STARTTLS\r\n250-AUTH PLAIN LOGIN\r\n250-ENHANCEDSTATUSCODES\r\n250 SMTPUTF8" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) STARTTLS" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 220 2.0.0 Ready to start TLS" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) EHLO devpc06" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 250-2a408247117c greets devpc06\r\n250-SIZE 0\r\n250-AUTH LOGIN PLAIN\r\n250-ENHANCEDSTATUSCODES\r\n250 SMTPUTF8" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) AUTH PLAIN" mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] response (10.4.99.1) 334 " mailpit-1 | time="2025/08/16 13:52:12" level=debug msg="[smtpd] received (10.4.99.1) AHVzZXIxAHBhc3N3b3JkMQ==" mailpit-1 | time="2025/08/16 13:52:12" level=warning msg="[smtpd] deny PLAIN login:\"user1\" from:10.4.99.1" mailpit-1 | time="2025/08/16 13:52:12" level=error msg="[smtpd] response (10.4.99.1) 535 5.7.8 Authentication credentials invalid" ``` If I replace `MP_SMTP_AUTH='user1:password1'` and specify `MP_SMTP_AUTH_ACCEPT_ANY=true` everything works fine... I also tried `MP_SMTP_AUTH='user1:<crypt-sha512-hash-of-password1>'` instead of plain password but that did not work either... Are my settings incorrect, or could this be some other issue? Thanks Z....

kerem closed this issue

2026-03-15 14:03:56 +03:00

kerem commented

2026-03-15 14:04:02 +03:00

Author

Owner

@axllent commented on GitHub (Aug 17, 2025):

OK, so this had me confused too as I was able to replicate what you were experiencing... until I realised what was wrong ~ This is not an issue with Mailpit, it's a problem with your syntax in the docker compose config file.

Using - MP_SMTP_AUTH='user1:password1' (or even - MP_SMTP_AUTH="user1:password1") you are actually passing Docker the value 'user1:password1' including the quotes, which is username = 'user1 with password password1' - the quote marks are included as part of the value. You either have to use - MP_SMTP_AUTH=user1:password1 (not quoted), OR you can alternatively set it as MP_SMTP_AUTH: user1:password1 without the - prefix.

Any of these work:

services:
  mailpit:
    image: axllent/mailpit:v1.27.4
    environment:
        MP_VERBOSE: true
        TZ: US/Eastern
        MP_SMTP_BIND_ADDR: :587
        MP_SMTP_TLS_KEY: sans:localhost
        MP_SMTP_TLS_CERT: sans:localhost
        MP_SMTP_REQUIRE_STARTTLS: true
        MP_SMTP_AUTH: user1:password1
    ports:
        - "8025:8025/tcp"
        - "587:587/tcp"

services:
  mailpit:
    image: axllent/mailpit:v1.27.4
    environment:
        MP_VERBOSE: true
        TZ: US/Eastern
        MP_SMTP_BIND_ADDR: ":587"
        MP_SMTP_TLS_KEY: "sans:localhost"
        MP_SMTP_TLS_CERT: "sans:localhost"
        MP_SMTP_REQUIRE_STARTTLS: true
        MP_SMTP_AUTH: "user1:password1"
    ports:
        - "8025:8025/tcp"
        - "587:587/tcp"

services:
  mailpit:
    image: axllent/mailpit:v1.27.4
    environment:
        - MP_VERBOSE=true
        - TZ=US/Eastern
        - MP_SMTP_BIND_ADDR=:587
        - MP_SMTP_TLS_KEY:=sans:localhost
        - MP_SMTP_TLS_CERT=sans:localhost
        - MP_SMTP_REQUIRE_STARTTLS=true
        - MP_SMTP_AUTH=user1:password1
    ports:
        - "8025:8025/tcp"
        - "587:587/tcp"

I hope this helps?

@axllent commented on GitHub (Aug 17, 2025): OK, so this had me confused too as I was able to replicate what you were experiencing... until I realised what was wrong ~ This is not an issue with Mailpit, it's a problem with your syntax in the docker compose config file. Using `- MP_SMTP_AUTH='user1:password1'` (or even `- MP_SMTP_AUTH="user1:password1"`) you are actually passing Docker the value `'user1:password1'` including the quotes, which is username = `'user1` with password `password1'` - the quote marks are included as part of the value. You either have to use `- MP_SMTP_AUTH=user1:password1` (not quoted), OR you can alternatively set it as `MP_SMTP_AUTH: user1:password1` without the `-` prefix. Any of these work: ```yaml services: mailpit: image: axllent/mailpit:v1.27.4 environment: MP_VERBOSE: true TZ: US/Eastern MP_SMTP_BIND_ADDR: :587 MP_SMTP_TLS_KEY: sans:localhost MP_SMTP_TLS_CERT: sans:localhost MP_SMTP_REQUIRE_STARTTLS: true MP_SMTP_AUTH: user1:password1 ports: - "8025:8025/tcp" - "587:587/tcp" ``` ```yaml services: mailpit: image: axllent/mailpit:v1.27.4 environment: MP_VERBOSE: true TZ: US/Eastern MP_SMTP_BIND_ADDR: ":587" MP_SMTP_TLS_KEY: "sans:localhost" MP_SMTP_TLS_CERT: "sans:localhost" MP_SMTP_REQUIRE_STARTTLS: true MP_SMTP_AUTH: "user1:password1" ports: - "8025:8025/tcp" - "587:587/tcp" ``` ```yaml services: mailpit: image: axllent/mailpit:v1.27.4 environment: - MP_VERBOSE=true - TZ=US/Eastern - MP_SMTP_BIND_ADDR=:587 - MP_SMTP_TLS_KEY:=sans:localhost - MP_SMTP_TLS_CERT=sans:localhost - MP_SMTP_REQUIRE_STARTTLS=true - MP_SMTP_AUTH=user1:password1 ports: - "8025:8025/tcp" - "587:587/tcp" ``` I hope this helps?

kerem commented

2026-03-15 14:04:07 +03:00

Author

Owner

@zam6ak commented on GitHub (Aug 17, 2025):

Thanks for the quick response...

This is quite strange as I have other services where environment variables are using array syntax where values after = are quoted.
How would you pass 2 or more values in case password had special characters (specifically "space") using this syntax?
As per docs, the space is delimiter for multiple credential pairs...

# 2 users with no special chars in password - OK
- MP_SMTP_AUTH=user1:password1 user2:password2

# "pass word1" and "pass word2" are the passwords with space...?
- MP_SMTP_AUTH=user1:pass word1 user2:pass word2

only way I can think of working around this is to read the values from .env file and leverage interpolation...

- MP_SMTP_AUTH=${SMTP_USERNAME1}:${SMTP_PASSWORD1} ${SMTP_USERNAME2}:${SMTP_PASSWORD2}

side note:
now that I am able to test w/ credentials, I am noticing that regardless of the credential pairs, I can still use any credentials. I even explicitly set :

- MP_SMTP_AUTH=user1:password1
- MP_SMTP_AUTH_ACCEPT_ANY=false

and am able to send email using any username and password...
Not sure if this is me doing something wrong so I didn't file it as a separate issue yet...

@zam6ak commented on GitHub (Aug 17, 2025): Thanks for the quick response... This is quite strange as I have other services where environment variables are using `array` syntax where values after `=` are quoted. How would you pass 2 or more values in case password had special characters (specifically "space") using this syntax? As per docs, the space is delimiter for multiple credential pairs... ``` # 2 users with no special chars in password - OK - MP_SMTP_AUTH=user1:password1 user2:password2 ``` ``` # "pass word1" and "pass word2" are the passwords with space...? - MP_SMTP_AUTH=user1:pass word1 user2:pass word2 ``` only way I can think of working around this is to read the values from `.env` file and leverage interpolation... ``` - MP_SMTP_AUTH=${SMTP_USERNAME1}:${SMTP_PASSWORD1} ${SMTP_USERNAME2}:${SMTP_PASSWORD2} ``` --- side note: now that I am able to test w/ credentials, I am noticing that regardless of the credential pairs, I can still use any credentials. I even explicitly set : ``` - MP_SMTP_AUTH=user1:password1 - MP_SMTP_AUTH_ACCEPT_ANY=false ``` and am able to send email using any username and password... Not sure if this is me doing something wrong so I didn't file it as a separate issue yet...

kerem commented

2026-03-15 14:04:12 +03:00

Author

Owner

@axllent commented on GitHub (Aug 18, 2025):

If you are using complicated passwords (or with a password with spaces) then you have two options:

use password encryption to end up with something like user1:$apr1$f0cpl62q$/WCTZYiEcTIreCdl7cQNu. (you can use a tool like https://www.web2generators.com/apache-tools/htpasswd-generator to encode it)
Store your usernames and passwords in a file and then use --smtp-auth-file (or env MP_SMTP_AUTH_FILE) [untested with spaces but I assume it should work]

I haven't got a clue why some apps work with quotes and others don't, but I suspect those apps which work may trim surrounding quotes in the data. Mailpit is literally just reading in the environment variables presented by Docker, so this seems a limitation in the Docker compose yaml when using arrays. I would advise you use the MP_SMTP_AUTH: "user1:password1" syntax rather than the - MP_SMTP_AUTH=user1:password1 in your compose yaml though as it's less problematic.

I also cannot replicate your "side note" observation on my end - if I change my credentials and run your script I get an authentication error. What I can say however is that Mailpit won't wok if you set both MP_SMTP_AUTH and MP_SMTP_AUTH_ACCEPT_ANY: true, and MP_SMTP_AUTH_ACCEPT_ANY: false is implied when using MP_SMTP_AUTH.

Hope this helps?

@axllent commented on GitHub (Aug 18, 2025): If you are using complicated passwords (or with a password with spaces) then you have two options: 1. use password encryption to end up with something like `user1:$apr1$f0cpl62q$/WCTZYiEcTIreCdl7cQNu.` (you can use a tool like https://www.web2generators.com/apache-tools/htpasswd-generator to encode it) 2. Store your usernames and passwords in a file and then use `--smtp-auth-file` (or env `MP_SMTP_AUTH_FILE`) [untested with spaces but I assume it should work] I haven't got a clue why some apps work with quotes and others don't, but I suspect those apps which work may trim surrounding quotes in the data. Mailpit is literally just reading in the environment variables presented by Docker, so this seems a limitation in the Docker compose yaml when using arrays. I would advise you use the `MP_SMTP_AUTH: "user1:password1"` syntax rather than the `- MP_SMTP_AUTH=user1:password1` in your compose yaml though as it's less problematic. I also cannot replicate your "side note" observation on my end - if I change my credentials and run your script I get an authentication error. What I can say however is that Mailpit won't wok if you set both `MP_SMTP_AUTH` and `MP_SMTP_AUTH_ACCEPT_ANY: true`, and `MP_SMTP_AUTH_ACCEPT_ANY: false` is implied when using `MP_SMTP_AUTH`. Hope this helps?

kerem commented

2026-03-15 14:04:17 +03:00

Author

Owner

@zam6ak commented on GitHub (Aug 18, 2025):

Thanks for your feedback!

@zam6ak commented on GitHub (Aug 18, 2025): Thanks for your feedback!