On 22/08/2025 09:04, Viktor Dukhovni via mailop wrote:
Any MTA that turns a temporary DNS failure (SERVFAIL rather than
NXDOMAIN) into a 5XX reject (rather than a 4XX softfail) is badly broken
and MUST NOT be used.
I personally have not run into any mainstream MTAs that are broken in
this way.
I'm really just thinking of the Microsoft DKIM problems that have come
up on this list a few times. From the discussions it seems that nobody
is too sure of the exact issue, but it generally seems to be related to
DNS. Maybe longer TTLs wouldn't help anyway.
We occasionally see rejects from Gmail when it thinks there is no PTR record
for the IP address that is sending the email, even though the record is
there.
The problem with these checks is that there is no retry mechanism - the
email is just rejected.
If failure to resolve SPF, DKIM, or DMARC related DNS records leads the
receiving MTA to issue a 5XX hard error, rather than a 4XX tempfail, the
receiving MTA (or its content inspection stack) is badly busted. As a
community with domain expertise, we need to make a fuss until any such
MTAs are fixed.
This is an example of the Gmail bounce we (very intermittently) see:
relay=gmail-smtp-in.l.google.com[142.251.16.27]:25, delay=2.9,
delays=0.1/0.21/0.63/2, dsn=5.7.25, status=bounced (host
gmail-smtp-in.l.google.com[142.251.16.27] said: 550-5.7.25
[91.234.234.172] The IP address sending this message does not have a
550-5.7.25 PTR record setup, or the corresponding forward DNS entry does
not 550-5.7.25 match the sending IP. As a policy, Gmail does not accept
messages 550-5.7.25 from IPs with missing PTR records. For more
information, go to 550-5.7.25
https://support.google.com/a?p=sender-guidelines-ip 550-5.7.25 To learn
more about Gmail requirements for bulk senders, visit 550 5.7.25
https://support.google.com/a?p=sender-guidelines. - gsmtp (in reply to
end of DATA command))
Andy
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
