Why do I receive an "Unauthenticated senders not allowed" error when trying to send emails from Splunk?

[mattstibbs]

I am having trouble sending emails from Splunk. My colleague can send them without an issue, however when I try to send them I get the following error:

command="sendemail", (550, 'Unauthenticated senders not allowed', u'splunk@aaa.bbb.uk') while sending mail to: xxx.yyy@zzz.net

I am a power user and we can't find any other settings that would be preventing me from sending that differ to his (which work).

What are we missing?

[jcrabb_splunk]

You are getting a 550 SMTP error from your mail system (not Splunk). I would check the mail system you are pointed at when you try to send the message to determine the issue. Based on the message, the sending address may not be permitted to relay or to send to that recipient. It could also mean the address is not valid. Again, I would check the logs on the mail host at the time the message was sent to better troubleshoot the issue.

[mattstibbs]

Thank you - we are using the generic configured email settings so I am ruling out there being any difference in settings between his use and mine.

I did find an article that suggested it might be because i don't have admin_all_objects permission - but that seems overkill just to send an email....

[adonio]

does your colleague uses the same splunk instance?

[mattstibbs]

yes - exactly the same