SMTP Mail Courier with AWS SMS SMTP Relay

[valentinyanakiev]

Hi,

I am trying to configure AWS SMS SMTP Relay as SMTP mail courier for Ory Kratos.
I have a set of AWS credentials - Access Key ID and Secret Access Key. Sending email through the AWS SMS Relay service in the following format works fine (saving the following message in email.txt):

EHLO alkem.io
AUTH LOGIN
[Base 64 encoded Access Key ID]
[Base 64 encoded Secret Access Key]
MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
From: Alkemio <[email protected]>
To: [email protected]
Subject: Amazon SES SMTP Test

TEST!!!
.
QUIT

Testing the mailing service with explicit SSL:
openssl s_client -crlf -quiet -starttls smtp -connect email-smtp.eu-central-1.amazonaws.com:587 < email.txt
and implicit SSL:
openssl s_client -crlf -quiet -connect email-smtp.eu-central-1.amazonaws.com:465 < email.txt

Both work fine, I get 250 OK .... and the mail is sent and received successfully.

Installing Ory Kratos via Helm (tried with versions v0.6.3-alpha.1 and v0.6.1-alpha.1) and enabling verification and recovery flows via:

        recovery:
          enabled: true

        verification:
          enabled: true

I have tried configuring the courier service with the following format(s) in courier / smtp:

connection_uri: smtps://[AWS SMS Access Key ID]:[AWS SMS Secret Access Key]@email-smtp.eu-central-1.amazonaws.com:587

I have tried smtp over smtps, changing the port to 465 etc. I always end up with the following in the logs:

time=2021-07-14T06:11:26Z level=info msg=Sending out verification email with verification link. audience=audit email_address=some_email@some_domain.com identity_id=d5681cea-848d-4195-89c6-4b399108cc9b service_name=Ory Kratos service_version=v0.6.3-alpha.1 verification_link_id=8e4bdd03-c93c-4b53-a7e7-2b0f4494fb0d verification_link_token=vE69mX1g2LpKjFjBy5k6tZOSv4YRjZLV via=email

Kratos db has the row created / updated, there is registration link etc. The only problem is, an email is actually not sent / received and even bigger problem is, log-wise, it looks like the whole flow passed successfully.

We are using a wildcard certificate for *.alkem.io issued by Let's Encrypt, if that helps.

What am I missing?

Thanks in advance,
Valentin

[aeneasr]

I suggest checking the SNS logs. Ory Kratos tries sending an email, setting up an SMS relay might be the problem, as Ory Kratos is sending emails formatted as emails with HTML etc.

[valentinyanakiev]

Thanks for the reply. I managed to overcome the problem on kratos 0.6.1-alpha1.
For others facing the same issue, here is what I have as setup:

1. Amazon Simple Email Service (SES) with several trusted identities, including the root level domain.
2. Kratos 0.6.1-alpha 1 installed via helm in k8s cluster.
3. SMTP User (AKIA...) and Password.
4. After configuring all the routes and endpoints for kratos (not in scope here), the smtp configuration that worked for me:

courier:
smtp:
from_address: [a verified email in SES)
connection_uri: smtp://[SMTP_Username]:[SMTP_Password]@email-smtp.eu-central-1.amazonaws.com:587/?skip_ssl_verify=false

SMTP_Username is 'as is' provided by AWS, in other words - not base 64-encoded or anything.
SMTP_Password needs to have '/' replaced by '%2F'.

The rest just worked.

Note: Replace email-smtp.eu-central-1.amazonaws.com with your SES endpoint, it is per region.

[vinckr]

SMS is now supported natively: https://www.ory.sh/docs/kratos/concepts/email-sms#sending-sms

[leodotcloud]

If someone lands here having issues with url.Parse while providing the AWS access/secret keys, they need to be encoded before specifying in the courier.smtp.connection_uri section of kratos.yml.

python3 -c "import urllib.parse, sys; print(urllib.parse.quote_plus(sys.argv[1]))" $AWS_SECRET_ACCESS_KEY