# HTTP response from a TCP SMTP endpoint, even though no HTTP routers are assigned to it

**URL:** <https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043>\
**Category:** Traefik v2\
**Tags:** tcp, docker-swarm\
**Created:** [January 7, 2023, 5:56pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043 "2023-01-07T17:56:50Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![knipknap](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/knipknap/32/2378_2.png) [@knipknap](https://community.traefik.io/u/knipknap)\
**Post date:** [January 7, 2023, 5:56pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/1 "2023-01-07T17:56:50Z")

</div>

I have created a TCP router with one endpoint (port 587) and mapped it to an SMTP service. When I open a connection to the endpoint, I get an HTTP error 400 (bad request). In other words, a HTTP router is listening on that endpoint, instead of the TCP router that I want to listen.

I have several HTTP/HTTPS routers on other endpoints, but all of them use explicit endpoints, so nothing except the TCP router should listen "by default". This is also what the Traefik user interface shows.

Here are the HTTP(s) routes, note that none of them is connected to "smtptls":

 ![Screenshot from 2023-01-07 18-37-54](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/0/0fd73d474c2e9d679ec6e89359683f16932069ea.png)

And here is the only TLS route, it is listening on port 587 according the Traefik:

 ![Screenshot from 2023-01-07 18-49-34](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/6/69a8cd90f458e81281887ace1ed9687bc0c16c6a.png)

But in reality, this is what happens:

> $ telnet [mail.mydomain.com](http://mail.mydomain.com) 587  
> Trying 1.2.3.4...  
> Connected to [mail.mydomain.com](http://mail.mydomain.com).  
> Escape character is '^]'.  
> HTTP/1.1 400 Bad Request  
> Content-Type: text/plain; charset=utf-8  
> Connection: close

Any idea what may be going on?

Here is [a Github link to the complete docker-compose.yml with all of the Traefik configuration](https://github.com/barebaric/traefik-swarm/blob/master/docker-compose.yml).

Any hints?

This is Traefik 2.9.6.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 7, 2023, 9:20pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/2 "2023-01-07T21:20:00Z")

</div>

Amazing `docker-compose.yml` 🙂

I would try to remove the line, that’s not needed:

> traefik.tcp.routers.mail\_relay.service=mail\_relay

From the [Traefik TCP docs](https://doc.traefik.io/traefik/routing/routers/#configuring-tcp-routers):

> If both HTTP routers and TCP routers listen to the same entry points, the TCP routers will apply _before_ the HTTP routers. If no matching route is found for the TCP routers, then the HTTP routers will take over.

Check [Traefik debug log](https://doc.traefik.io/traefik/observability/logs/#level) and [access log](https://doc.traefik.io/traefik/observability/access-logs/) to find out what service your are connected to.

Are you sure `knipknap/docker-simple-mail-forwarder` is configured correctly? Can it respond with http in error case?

---

<div class="post-metadata">

**Author:** ![knipknap](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/knipknap/32/2378_2.png) [@knipknap](https://community.traefik.io/u/knipknap)\
**Post date:** [January 7, 2023, 9:44pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/3 "2023-01-07T21:44:41Z")

</div>

Thank you for the the tips! I tried to comment out the line as suggested and since it doesn't seem to change the behavior it seems indeed not needed; however, it also doesn't fix the problem.

I checked the logs (using `docker service logs -n10000 -f myswarm_traefik`).  
Since both, the debug log and the access log are by default written to stdout according to the docs, everything ends up visible there.

However, I found no errors, and the access log entry looks like this:

> myswarm\_traefik.1.x3ccfc5zpc6f@swarm | 10.0.0.2 - - [07/Jan/2023:21:31:14 +0000] "GET / HTTP/1.1" - - "-" "-" 806 "-" "-" 0ms

The last three _should_ be the interesting ones: According to the docs, they include:

> "\<Traefik\_router\_name\>" "\<Traefik\_server\_URL\>" \<request\_duration\_in\_ms\>ms

So as you can see, the router name is empty. So unfortunately, the mystery continues.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 7, 2023, 10:02pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/4 "2023-01-07T22:02:18Z")

</div>

Just some ideas: Try a telnet with

```auto
GET / HTTP/1.0

```

or shut down services to see which one it is.

Check the logs of your target service if it accessed.

Replace HTTPChallenge with TLSChallenge.

By the way, you can do a central `http->https` [redirect in entrypoints](https://doc.traefik.io/traefik/routing/entrypoints/#redirection), saves a lot of labels.

---

<div class="post-metadata">

**Author:** ![knipknap](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/knipknap/32/2378_2.png) [@knipknap](https://community.traefik.io/u/knipknap)\
**Post date:** [January 7, 2023, 10:42pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/5 "2023-01-07T22:42:44Z")

</div>

Using `GET / HTTP/1.0` is how I got that log message I posted 🙂.

Good idea about shutting down all services. I tried that (and shut down all other stacks, too), but even with only Traefik and mail\_relay running, the issue remains the same. The info in the access log also didn't improve.

I also replaced HTTPChallenge with TLSChallenge, again with no effect on the problem.

Man, this is tough to crack.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 8, 2023, 1:01pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/6 "2023-01-08T13:01:39Z")

</div>

Did a little reading and testing 🙂

On plain TCP connections you don't have the domain information. This is only included in a http request - or - within a TLS/SSL request.

Hypothesis: When you do a `telnet` to the IP, you don't use TLS (which is set as required for mail-forward), so Traefik will not have any matching service and fall back to http.

To test a TLS-encrypted TCP connection to your mail-forward just use

```auto
openssl s_client -connect mail.example.com:587

```

This worked for me to connect to a standard `istio/tcp-echo-server`.

```auto
version: '3.9'

services:
  tcpecho:
    image: istio/tcp-echo-server:1.2
    hostname: tcp-echo-server
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.tcpecho.entrypoints=tcp9000
      - traefik.tcp.routers.tcpecho.rule=HostSNI(`echo.example.com`)
      - traefik.tcp.routers.tcpecho.tls.certresolver=myresolver
      - traefik.tcp.services.tcpecho.loadbalancer.server.port=9000

```

---

<div class="post-metadata">

**Author:** ![knipknap](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/knipknap/32/2378_2.png) [@knipknap](https://community.traefik.io/u/knipknap)\
**Post date:** [January 8, 2023, 1:05pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/7 "2023-01-08T13:05:19Z")

</div>

Oh wow, that is it! You found the solution, trying through OpenSSL it works immediately!

Amazing. Though weird that Traefik falls back to HTTP on such a port, and without router info in the log, super confusing.

Thanks a lot for your help!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 8, 2023, 1:43pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/8 "2023-01-08T13:43:34Z")

</div>

You are welcome, always happy to help buddies using Docker Swarm 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [January 11, 2023, 1:43pm UTC](https://community.traefik.io/t/http-response-from-a-tcp-smtp-endpoint-even-though-no-http-routers-are-assigned-to-it/17043/9 "2023-01-11T13:43:42Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.