Outbound delivery to mailbox.org always queued because of bogus DNSSEC validation

Issues
1

Issue Description

Outbound SMTP works correctly for

Gmail
GMX

several private domains

Only mailbox.org is never delivered.

The Event Viewer reports

Bogus DNSSEC record
Details: MX

Immediately afterwards the message is rescheduled.

No TCP connection attempt is made.

tcpdump confirms there is no SYN packet to the mailbox.org MX hosts.

Actual Behavior

Outbound delivery to mailbox.org always queued because of bogus DNSSEC validation

Reproduction Steps

Validation
delv mailbox.org MX

returns

fully validated
delv _25._tcp.mx1.mailbox.org TLSA

returns

fully validated
openssl s_client -starttls smtp -connect mx1.mailbox.org:25

works successfully.

Expected

Message should be delivered.

Actual

Queue retry

Bogus DNSSEC record

although DNSSEC validation succeeds using BIND tools.

Relevant Log Output

journalctl -fu stalwart shows no SMTP or queue log entries during successful deliveries (Gmail) or failed mailbox.org deliveries.
tcpdump -ni any host 80.241.60.212 or host 80.241.60.217

No SYN packets were generated by Stalwart.

Stalwart Version

v0.16.x

Installation Method

Binary (Linux)

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

A working workaround is:

TLS strategy new policy ‘no dane’ and DANE=disable

MTA → Outbound → Strategy → TLS

if ends_with(mx, “.mailbox.org”)
then “no dane”

After disabling DANE only for mailbox.org MX hosts, outbound delivery succeeds immediately.

The following MX hosts have been tested and all exhibit the same behaviour when DANE is enabled:

  • mx1.mailbox
  • mx2.mailbox
  • mx3.mailbox
  • mx4.mailbox

With DANE disabled for these MX hosts, delivery succeeds immediately.

I am happy to perform additional tests or provide further diagnostics if needed. Since this is a fresh test installation, I can easily reproduce the issue and test experimental builds or patches.

3

See Bogus DNSSEC but no errors in dnsviz

4

would you please change it like this because “” is not accepted in stalwart.

if ends_with(mx, ‘.mailbox.org’)
then ‘no dane’

5

sorry, it’s not possible to edit. The post is too old.