@Mail Domain Check

Authentik | ResultTimeout | Worker SMTP evidence

Authentik ak test_email ResultTimeout: Find the Real SMTP Error

ResultTimeout says the command did not receive a background-task result in time. It does not identify a network timeout. The actionable SMTP or configuration error can exist only in the worker that opened the backend and attempted the send.

The public scan is free. A complete prioritized report is 1 USDC on Base and is delivered automatically without an account or email address.

What ResultTimeout proves

At reviewed Authentik revision 658ee6062b2f85c5bc8e54b2772e5d11de49de67, the test command creates a message, dispatches send_mail, and waits with get_result(block=True). The worker separately resolves the email backend, opens it, reconstructs the message, calls send_messages, and records a sent event only after that call returns.

This yields two different observations. The command can time out waiting while the worker has already logged a concrete configuration, DNS, TLS, authentication, sender, recipient, or DATA error. Conversely, command success is still not proof of provider acceptance, recipient-server delivery, inbox visibility, authentication, or a usable verification link.

The planner below receives no email address, domain, SMTP host, username, password, environment, message, traceback, token, cookie, header, provider identifier, or log. It evaluates four categorical selections in this browser. The optional public scan sends one public domain only.

Browser-local diagnostic planner

Find the first unproved email boundary

Classify the command, matching worker attempt, provider outcome, and controlled receiver. All 256 combinations are evaluated locally.

Capture the worker outcome for one attempt

  1. Choose a controlled recipient and record the UTC start time locally. Do not put the address in a public issue.
  2. Open a short worker-log window before the test. Docker deployments can use docker compose logs --since 5m worker; Kubernetes deployments can use kubectl logs --since=5m deployment/authentik-worker -c worker. For another service manager, read only the worker unit for the same short window.
  3. Run one test from the current worker: ak test_email <controlled-recipient>. For a stage-specific backend, add -S <stage-name>.
  4. Find the matching send_mail attempt. Retain only its terminal exception class, enhanced SMTP status and response, success/failure state, UTC time, and an opaque task or provider identifier.
  5. Redact the address, message content, credential, token, cookie, private host, full environment, and unrelated log entries before sharing any evidence.

Authentik's logging guidance supports bounded --since windows. It also warns that trace logging can expose session cookies. A normal worker error should be collected before enabling trace; if trace is ever required, keep it private and disable it immediately afterward.

Classify the terminal worker error

Backend configuration
A backend-construction error, invalid setting, or simultaneous TLS modes should be fixed before testing the network.
DNS or connection
Name resolution, refusal, route, firewall, or socket timeout means no authenticated SMTP session was established.
TLS
Certificate verification, protocol, or handshake errors require the provider's exact mode and trust chain. Port 587 usually uses explicit STARTTLS; port 465 usually uses implicit TLS.
Authentication
An SMTP 535 or authentication exception concerns the current worker's effective account, credential, mechanism, and provider policy, not SPF or DMARC.
Envelope or DATA
Sender, recipient, relay, policy, content, or quota rejections must preserve the exact enhanced status. Repair the named condition before retrying.
No matching task
Treat missing worker evidence as a queue, database notification, worker health, or correlation problem. SMTP was not yet proven to run.

For a redacted SMTP status or exception text, use the browser-local SMTP error decoder. It does not send the entered text to the server.

Check only the configuration implicated by the error

Authentik's current email documentation separates global settings from stage-specific settings. Confirm whether the command used the global backend or -S, then inspect the effective worker configuration for that exact path. Do not assume the server container and worker have the same current environment.

  • STARTTLS or explicit TLS normally uses AUTHENTIK_EMAIL__USE_TLS=true and USE_SSL=false.
  • Implicit TLS normally uses AUTHENTIK_EMAIL__USE_SSL=true and USE_TLS=false.
  • Never enable both modes together. Use the provider's documented host, port, authentication policy, and sender identity.
  • After a Secret or environment change, prove the worker restarted onto the new revision before repeating the test.
  • A private CA requires the intended certificate bundle in the worker and a bounded trust configuration; never disable certificate verification as a diagnosis.

Do not stop at worker success

After the worker reports mail sent, correlate the same attempt with a provider event or final SMTP reply. Classify accepted, delayed, bounced, suppressed, or rejected. If it was accepted, follow asynchronous status to the recipient server and then the controlled mailbox. A visible message should be checked from its own trusted original header for aligned SPF or DKIM and DMARC pass.

If the real Authentik flow sends a one-time code or link, test only the newest one once. Provider acceptance and inbox visibility do not prove that the link maps to the intended account, remains valid, or completes the flow.

Decode the real error, then check the public sender

Start with the redacted worker-side status. Use the public domain scan only after the error points to sender authentication or after one real message reaches a trusted receiver.

Decode SMTP error

Primary references