Project: stellamica

Project ID: 4702ac0f-d1de-4e77-8628-26e27836cb12

Environment: production (9d7b62dc-5fea-4752-8fd2-f3b3a8abdbbe)

Service: stellamica (backend) — service ID f89f4c3d-47da-4433-afd4-5335abe5e7c7

Region: sfo

Current deployment ID: 2474cac0-04f4-4af5-bdc0-4c2281cce146

Runtime: Node.js (nixpacks build), Node/nodemailer TCP+TLS socket connection

Egress IP: 162.220.232.218

Issue: our backend cannot establish outbound TCP connections to smtp.hostinger.com on port 465 (implicit TLS) or port 587 (STARTTLS). Every attempt hangs and times out (ETIMEDOUT at the TCP connect stage — no SYN-ACK, no RST, no response at all) rather than being actively refused. Port 25 was never used or tested — only 465 and 587.

Destination / DNS: smtp.hostinger.com resolves to:

A (IPv4): 172.65.255.143

AAAA (IPv6): 2606:4700:90:0:f225:a1af:129b:4ba1

(both Cloudflare-owned ranges — Hostinger's mail appears to be Cloudflare-proxied)

We tested against both the hostname and the literal resolved IPv4 address directly (to rule out DNS/resolver-order issues) — same timeout result either way, on both ports.

Exact failed attempts (UTC, from our application logs):

2026-07-23T09:17:06.261Z — connect attempt, port 587, ETIMEDOUT

2026-07-23T09:19:06.179Z — connect attempt, port 587, ETIMEDOUT

2026-07-23T09:21:08.453Z — connect attempt, port 587, ETIMEDOUT

(earlier attempts against port 465 on 2026-07-23 ~08:30–09:00Z show the same pattern)

Control test: the exact same destination (same hostname, IP, ports, and credentials) connects and authenticates successfully within milliseconds from a non-Railway network — confirmed via the mail provider's own mailbox login logs, which show successful SMTP logins from a residential IP and zero entries at all from our Railway egress IP (162.220.232.218). This indicates no connection from our Railway egress IP reached the provider's authenticated SMTP layer.

Scope: this project has only this one service, deployed only in the sfo region, so we have not tested other Railway services or other regions — we can't yet confirm whether this is isolated to this service/container/region or affects Railway egress more broadly. Happy to test further if that would help isolate it.

Request: Please check outbound firewall policy, NAT routing, and upstream filtering for 162.220.232.218 to smtp.hostinger.com on TCP ports 465 and 587. Please confirm whether these connections are being dropped before TCP establishment and advise the supported remediation