I believe this to be a relatively recent regression since we started
to preserve the incoming domain name in RCPT TO, rather than
normalizing it. (2026.04.09-ea3b2a9b)
refs: https://github.com/KumoCorp/kumomta/issues/533
Two main cases:
* If the user accidentally places files in the directory that
are not kumo-jsonl compatible segments, then we won't trip
over them and stop processing.
* If the log segments are incomplete (eg: kumod was SIGKILL'd)
then we log the issue and avance to the next segment
The docker/metadata-action config relied on the default flavor
(latest=auto), which adds :latest when the ref is the default branch
or a SemVer git tag. Our release tags are date-based (e.g.
2026.03.04-bb93ecb1) and are not SemVer, so the SemVer rule never
fired and every push to main re-pointed :latest at the dev build.
The inline "produce latest tag when tagging" comment on
type=ref,event=tag was misleading — that entry only emits a tag
matching the git tag name, it does not produce :latest.
Set flavor: latest=false to disable the implicit behavior, and add
an explicit type=raw,value=latest entry gated on github.ref_type ==
'tag' so :latest moves only on release tag pushes.
refs: https://github.com/KumoCorp/kumomta/issues/511
Note: need to pin hierarchical_hash_wheel_timer back because the latest
version requires a rustc upgrade, and current versions of mlua don't
build against it when the send feature is enabled.
Some upstream peers (e.g. QQ Mail's rate-limiter) silently hold a
proxied TCP connection open indefinitely — sending no data, FIN, or RST
— rather than cleanly refusing. Without some kind of timeout
management, the two file descriptors for such a session remain open for
the lifetime of the process, slowly exhausting the kernel's
file-descriptor table and occupying proxy-server worker slots.
This commit configures kernel level keepalive options with reasonable
defaults to detect and close out this class of connection.
Co-authored-by: Wez Furlong <wez@wezfurlong.org>
Closes: https://github.com/KumoCorp/kumomta/pull/509
import_headers takes an array of per-spec option tables, each describing
how a single header name or pattern should be imported into the message
metadata. Compared to import_x_headers it adds:
* Trailing-`*` wildcard patterns (e.g. `X-*`) alongside exact names.
Bare/leading/interior wildcards are rejected at compile time.
* `match` of `first`, `last` (default), or `all`. `all` captures every
matching header instance as an array of strings; the others capture
a string. Specs that produce no matches write nothing.
* `transform` selects the metadata key style: `snake_case` (default,
matches the existing import_x_headers behavior), `kebab_case`,
`camel_case`, or `pascal_case`. Header matching itself is always
case-insensitive.
* `target` overrides the metadata key for exact-name specs.
* `remove` strips the matched headers from the message body in a
single follow-up pass.
When more than one spec could match a header, the first matching spec
wins, so callers can place specific rules ahead of a wildcard catch-all.
import_x_headers now delegates to import_headers, so its behavior is
unchanged and the two share a single implementation.
retain_headers now passes the header index alongside the &Header to its
closure, which import_headers uses for its post-pass removal step
instead of tracking a parallel counter. Existing callers that don't
need the index ignore it with `_`.
Closes: #515
The `psl` crate's domain_str / suffix_str do byte-exact lookups against
the public-suffix list, so uppercase or trailing-dot inputs (e.g.
"Example.COM" or "example.com." from a DNS Name) silently return None.
Several call sites were passing through user- or DNS-supplied domains
unmodified.
Add a small psl-utils crate that wraps the psl crate:
* normalize_domain(&str) -> Cow<str>: strips a single trailing dot and
lowercases ASCII; borrows when the input is already normalized so
the hot path (alignment loop) doesn't allocate.
* domain_str / suffix_str: thin re-exports for callers that have
already normalized.
psl-utils becomes the only workspace crate that directly depends on
the psl crate; kumo-dmarc and mod-string switch to depending on
psl-utils instead.
Updated call sites:
* kumo-dmarc record.rs: is_relaxed_aligned / is_strict_aligned now
normalize both inputs first. Replaces the prior eq_ignore_ascii_case
comparisons.
* kumo-dmarc lib.rs: the organizational-domain fallback in
DmarcContext::check now normalizes from_domain before calling
domain_str and compares against the normalized form. Previously a
mixed-case From: header would skip the _dmarc.<org> lookup entirely.
* mod-string lib.rs: the Lua-exposed string.psl_domain and
string.psl_suffix bindings normalize their input. Behavior change:
inputs that previously returned nil due to case or trailing dot now
resolve.
Co-authored-by: Wez Furlong <wez@wezfurlong.org>
Closes: https://github.com/KumoCorp/kumomta/pull/513
Two bugs in the alignment logic added in the prior commit:
* auth_result_is_pass read auth_result.props["result"], but the
pass/fail status lives in the AuthenticationResult.result field.
Real callers don't populate a "result" key in props, so every DKIM
and SPF entry was treated as non-pass and skipped. Take
&AuthenticationResult and inspect .result directly.
* When no alignment succeeded and no per-method errors were recorded
(e.g. no DKIM signatures, SPF not pass), evaluate() fell through to
Disposition::Pass / "Success", silently passing unauthenticated
mail. Return the published policy disposition with context
"No aligned DKIM or SPF" instead.
Add regression tests dmarc_both_spf_and_dkim_fail_returns_fail (covers
the fall-through) and dmarc_dkim_relaxed_subdomain_reverse (relaxed
alignment when d= is a subdomain of From).
Surface the underlying DKIM signature tags and the published DMARC
policy tags as auth-result props, so callers (and downstream
Authentication-Results headers) can see what was actually checked.
DKIM (crates/dkim):
* Factor populate_props() over the parsed tagged-header and emit
header.d, header.i, header.a, header.s, header.c, header.t and
header.x. The previous code only emitted d/i/a/s on the success
path.
* On DKIMHeader::parse failure, fall back to a generic TaggedHeader
parse so the resulting permerror AuthenticationResult still carries
whatever tags were extractable (e.g. for expired signatures we now
surface header.d and header.x). Covered by a new roundtrip test.
DMARC (crates/kumo-dmarc, crates/kumod):
* Record now retains the raw key=value tags it parsed, exposed via
Record::tags().
* DispositionWithContext carries a new props map. Record::evaluate
initialises it empty; drop the no-longer-relevant ToXml derive.
* DmarcContext::check copies the matched record's tags into the
result props as policy.<tag> via a new policy_tags() helper.
* kumod's dmarc.rs threads result.props through into the
AuthenticationResult returned to Lua (rather than starting empty),
preserving the existing policy.published-domain-policy insertion
for Quarantine/Reject.
Rework the alignment evaluation in Record::evaluate. Previously every
misaligned DKIM or SPF result produced an alignment_failure, with no
notion of "DKIM didn't pass at all" — and no early-out when one method
did align. DMARC requires only a single passing-and-aligned method, so:
* For each DKIM result, skip entries whose underlying DKIM check did
not return pass (consulted via the auth-result "result" prop). On
the first aligned passing signature record cx.dkim_aligned = Pass,
drop accumulated per-signature errors, and stop iterating.
* For SPF, only consider alignment when the SPF result was pass.
Source the SPF identity from the auth-result "smtp.mailfrom" /
"smtp.helo" props (falling back to cx.mail_from_domain), so we
align against what was actually authenticated upstream.
* If either method aligned, return Pass. Otherwise surface the first
SPF or DKIM alignment-failure context as the policy result.
Factor the comparisons out into helpers: is_relaxed_aligned (org-domain
match via psl::domain_str) and is_strict_aligned (exact match), both
case-insensitive. Replaces ad-hoc as_bytes() / BStr comparisons.
Add tests dmarc_dkim_ignores_non_pass_results,
dmarc_dkim_continues_until_aligned_result and
dmarc_spf_ignores_non_pass_result, and update the evaluate_ip helper
to populate the "result" / "smtp.mailfrom" props the new logic reads.
RFC 7208 §2.4 says that when the SMTP MAIL FROM is null (e.g. bounces)
the SPF check should fall back to the HELO/EHLO identity with a
local-part of "postmaster". Two gaps prevented that:
* CheckHostParams::check left `domain` empty when MAIL FROM was blank,
producing a synthesized sender of "postmaster@" with no domain.
Fall back to ehlo_domain when domain is empty.
* SpfContext::new returned PermError for any sender lacking an '@',
rejecting bare HELO identities outright. Treat a sender with no '@'
as ("postmaster", <sender as domain>).
Add a regression test covering SpfContext::new with a bare HELO
identity.
Rust 1.93 causes TimeDelta::__add to fail when adding a userdata to
itself with a bland "error borrowing userdata" error message.
Go back to 1.92 to unblock builds for the moment.
The start of reporting support for DMARC. We create the report from the
errors we encounter, though we do not yet have this wired into the email
reporting system.
Our main task is collecting the errors, though where we put them still
needs to be decided. Currently, a temporary file is used.
Once collected, the errors can be aggregated and built into the RFC 7489-compliant report.
Co-authored-by: Wez Furlong <wez@wezfurlong.org>
Closes: https://github.com/KumoCorp/kumomta/pull/463
This was previously just returning everything before the final at-sign.
Now we use the same parsing approach and return the normalized local
part.
This is technically a breaking change, but it is minor and improves
the overall state of things.
I recently tweaked things to allow ctrl-c to interrupt a long running
--script mode execution, but this had the consequence of breaking
propagation of errors raised in the script to the exit code of
the process, meaning that our lua-based tests would print errors
but not break the runner, making it hard to notice if a regression
was introduced.
This commit resolves that by providing an explicit channel for passing a
return code (rather, an error) through when requesting shutdown.
A number of fields are typed as BString but the parser won't allow
non-UTF8 text through. Let's type those as String because it
simplifies a lot of of downstream logic.
Mike Hillyer
Wez Furlong
Harsh Jha
Aditya Ganti
kay ozaki
Oleg Orekhov
dependabot[bot]
Jack
sophiajt