Sender Authentication strategy

Questions
1

Your question

Hi,

I have a question regarding adding an exception to Inbound verification strategy.
I have an UPS which is sending an unusual EHLO command (EHLO InsightPower) and the server is rejecting with an error:
INFO Invalid EHLO command (smtp.invalid-ehlo) listenerId = “smtp”, localPort = 25, remoteIp = 10.10.10.20, remotePort = 54188, domain = “InsightPower”

I modified the MTA->Inbound->Sender Authentication->SPF Verification->EHLO
if local_port == 25 && remote_ip == ‘10.10.10.20’
then disable
if local_port == 25
then strict
else disable
Now I can see the exception evaluated corectly:
2026-07-10T11:16:25Z TRACE Expression evaluation result (eval.result) listenerId = “smtp”, localPort = 25, remoteIp = 10.10.10.20, remotePort = 54188, id = “SenderAuth with id singleton”, key = “spfEhloVerify”, result = “Constant(Disable)”
But the connection is still rejected:
2026-07-10T11:16:25Z TRACE Raw SMTP input received (smtp.raw-input) listenerId = “smtp”, localPort = 25, remoteIp = 10.10.10.20, remotePort = 54188, size = 19, contents = “EHLO InsightPower\r\n”
2026-07-10T11:16:25Z INFO Invalid EHLO command (smtp.invalid-ehlo) listenerId = “smtp”, localPort = 25, remoteIp = 10.10.10.20, remotePort = 54188, domain = “InsightPower”

If I’m trying to use port 465 with authentication I’m receiving this error:
2026-07-10T07:56:45Z DEBUG TLS handshake error (tls.handshake-error) listenerId = “submissions”, localPort = 465, remoteIp = 10.10.10.20, remotePort = 49224, reason = “tls handshake eof”

What can I do?

Thanks,
Andrei

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The rejection you’re seeing (smtp.invalid-ehlo) is not caused by the SPF EHLO check, it’s the rejectNonFqdn setting on the MtaStageEhlo singleton, which by default rejects any EHLO parameter that isn’t a fully-qualified domain name on port 25 (InsightPower has no dot, so it fails this check regardless of what you set on SPF verification). You need to add your exception there instead:

{
  "rejectNonFqdn": {
    "match": [
      {"if": "local_port == 25 && remote_ip == '10.10.10.20'", "then": "false"},
      {"if": "local_port == 25", "then": "true"}
    ],
    "else": "false"
  }
}

This is a WebUI/JMAP singleton under Settings › MTA › Session › EHLO Stage (MtaStageEhlo), separate from the SenderAuth object you edited for SPF. See EHLO stage docs.

For the second problem, port 465 (submissions) expects TLS to start immediately (implicit TLS), and the “tls handshake eof” error means the UPS is likely sending plaintext SMTP on that port instead of a TLS ClientHello, so the connection drops before any handshake completes. If the device doesn’t support implicit TLS, configure it to use port 587 (STARTTLS) or plain port 25 instead, since implicit TLS on 465 can’t be negotiated with a client that isn’t actually initiating TLS.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.