Skip to content

feat: do not bind SMTP client sockets to public addresses#932

Merged
link2xt merged 2 commits intomainfrom
link2xt/dont-bind-src-addr
Apr 27, 2026
Merged

feat: do not bind SMTP client sockets to public addresses#932
link2xt merged 2 commits intomainfrom
link2xt/dont-bind-src-addr

Conversation

@link2xt
Copy link
Copy Markdown
Contributor

@link2xt link2xt commented Apr 22, 2026

This change reverts 06560dd

Main reason for using the same address for sending as the one used in DNS is to pass FCrDNS
(forward-confirmed reverse DNS) checks:
IP address used by SMTP client should resolve
to the domain which in turn resolves to the same IP. chatmail relays don't do check reverse DNS
for incoming connections,
but other email servers may do and reject email
if the check does not pass.

Most chatmail relays only have one IP address per address family, so this configuration does not change anything.

For chatmail relays that have multiple addresses
and only publishing one IP to DNS,
source address used for outgoing SMTP connections
should be the public IP.

This can be ensured by configuring the source
address in the routing table,
e.g. with the src argument
to ip route add/change/replace command.

Solving this by binding SMTP client address
on the application level prevents chatmail relays
from configuring alternative routes.

Besides, some chatmail relays are NATed
and NAT is responsible for translating the address to the public one, in which case using smtp_bind_address_enforce
will result in unnecessarily deferring all mails.

@link2xt link2xt marked this pull request as draft April 22, 2026 14:41
@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Apr 22, 2026

Draft because I still want to add some docs.

@link2xt link2xt temporarily deployed to staging.chatmail.at/doc/relay/ April 22, 2026 18:01 — with GitHub Actions Inactive
@link2xt link2xt marked this pull request as ready for review April 22, 2026 18:01
@link2xt link2xt requested review from j4n and missytake April 22, 2026 18:02
@ccclxxiii ccclxxiii self-requested a review April 22, 2026 18:20
Copy link
Copy Markdown
Contributor

@missytake missytake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the extensive documentation!

(If anyone wants to check: https://staging.chatmail.at/doc/relay/932/reverse_dns.html )

link2xt added 2 commits April 27, 2026 18:33
This change reverts 06560dd

Main reason for using the same address for sending
as the one used in DNS is to pass FCrDNS
(forward-confirmed reverse DNS) checks:
IP address used by SMTP client should resolve
to the domain which in turn resolves to the same IP.
chatmail relays don't do check reverse DNS
for incoming connections,
but other email servers may do and reject email
if the check does not pass.

Most chatmail relays only have one IP address per address family,
so this configuration does not change anything.

For chatmail relays that have multiple addresses
and only publishing one IP to DNS,
source address used for outgoing SMTP connections
should be the public IP.

This can be ensured by configuring the source
address in the routing table,
e.g. with the `src` argument
to `ip route add/change/replace` command.

Solving this by binding SMTP client address
on the application level prevents chatmail relays
from configuring alternative routes.

Besides, some chatmail relays are NATed
and NAT is responsible for translating the address to the public one,
in which case using `smtp_bind_address_enforce`
will result in unnecessarily deferring all mails.
@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Apr 27, 2026

Updated the documentation a bit to mention IP reputation which is apparently the main reason for floating IP.

@link2xt link2xt merged commit 454ac62 into main Apr 27, 2026
5 checks passed
@link2xt link2xt deleted the link2xt/dont-bind-src-addr branch April 27, 2026 16:43
@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Apr 27, 2026

Merged it already because it seems unlikely that we decide the approach of using routing table for multi-homed setups does not work. Worst case we can revert it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants