and also in resolve-shaping-domain, for consistency.
We can use the message rate from the scheduled queue config to refine
the computed ceilings/constraints too, which is nice.
This can be computed for an EgressPathConfig and is useful to indicate
what the effective ceilings are for this egress path.
We return this from inspect-ready-q
The ready queue maintainer now tracks for each dispatcher whether it
is making progress. If it exceeds dispatcher_progress_watchdog_timeout
then the task will be aborted and any message(s) it held onto will
be returned to the scheduled queue. This will free up the connection
slot and allow another connection to be attempted, potentially
making further progress.
refs: https://github.com/KumoCorp/kumomta/issues/539
These are speculative defensive changes made in response to
refs: https://github.com/KumoCorp/kumomta/issues/539
I do not believe that either of these fix the underlying issue,
because we don't have enough data to know for sure, and the
reported behavior doesn't quite match up.
Two things:
1. While the STARTTLS verb itself respected the client timeouts,
the underlying handshake was issued without a surrounding handshake,
which meant that if something bad happened mid handshake and we
got stalled, we'd stall indefinitely. It's not clear that this
is the root cause of the issue above, as the user reported that
they've seen sessions hang after successfully being established.
2. Similarly, we'd use the client timeouts for other verbs, but the
flushes we issue were not included within their scope. So again
we could potentially wedge here with no timeout. It's not clear
that this is the root cause either, because analsis of the code
and building out a mock wedging implementation (not included in
the final commit here) couldn't trigger a situation that manifested
the way the issue described.
Egress sources can now be configured to auto-suspend when their local
bind address appears unplumbed or when their configured proxy server
appears unreachable. A suspended source is skipped during pool selection
until the configured duration elapses.
We'll expand these to a list of candidate addresses, trying each in
turn. We use the same overall connect timeout regardless of how
many candidates are present, to respect that timeout bound.
closes: https://github.com/KumoCorp/kumomta/pull/402
We recently investigated an issue where a rocksdb had been damaged by
corrupting/removing SST files (it sounded like this was accidentally
self-inflicted by some backup/orchestration infrastructure) leaving the
system in a silently-broken state: writes just wouldn't make progress
and there were no error messages.
Inspecting the `/var/spool/kumomta/data/LOG` log file (which is a
readable text file) revealed messages like:
```
2026/06/12-14:55:31.884227 2875746 [ERROR] [db/compaction/compaction.cc:262] Unable to load table properties for file 29704 --- IO error: No such file or directory: While open a file for random read: /var/spool/kumomta/data/029704.sst: No such file or directory
2026/06/12-14:55:31.884311 2875746 [ERROR] [db/db_impl/db_impl_compaction_flush.cc:3385] Waiting after background compaction error: IO error: No such file or directory: While open a file for random read: /var/spool/kumomta/data/029704.sst: No such file or directory, Accumulated background error counts: 6363
```
This commit improves the observability in this situation by proactively
checking for error conditions:
1. The store() and remove() operations now use our own polling within
a deadline loop rather than spawning a blocking task and delegating
to rocksdb's blocking interface. This allows us to inspect the
background error count and be cancellable, safely respecting and
caller provided smtp max transaction duration.
2. All read and write operations check for IO and Corruption errors
and immediately latch an error state
3. The metrics monitoring task inspects and track background error
counts and latch us into an unhealthy state when the background
error state appears unhealthy and persistent.
4. Additional metrics are exposed to help monitoring and alerting
While adding integration test coverage for this, I found a typo that
meant that spool errors were ignored in the message crate; they got
silently converted to `true` in all cases rather than just mapping
the success case to a `true`.
Integration tests handle the case where an SST file is corrupted
(truncated) during runtime, as well as starting up when an SST file
is missing. These excercise both the foreground and background
error detection paths.
I believe this to be a relatively recent regression since we started
to preserve the incoming domain name in RCPT TO, rather than
normalizing it. (2026.04.09-ea3b2a9b)
refs: https://github.com/KumoCorp/kumomta/issues/533
Two main cases:
* If the user accidentally places files in the directory that
are not kumo-jsonl compatible segments, then we won't trip
over them and stop processing.
* If the log segments are incomplete (eg: kumod was SIGKILL'd)
then we log the issue and avance to the next segment
The docker/metadata-action config relied on the default flavor
(latest=auto), which adds :latest when the ref is the default branch
or a SemVer git tag. Our release tags are date-based (e.g.
2026.03.04-bb93ecb1) and are not SemVer, so the SemVer rule never
fired and every push to main re-pointed :latest at the dev build.
The inline "produce latest tag when tagging" comment on
type=ref,event=tag was misleading — that entry only emits a tag
matching the git tag name, it does not produce :latest.
Set flavor: latest=false to disable the implicit behavior, and add
an explicit type=raw,value=latest entry gated on github.ref_type ==
'tag' so :latest moves only on release tag pushes.
refs: https://github.com/KumoCorp/kumomta/issues/511
Note: need to pin hierarchical_hash_wheel_timer back because the latest
version requires a rustc upgrade, and current versions of mlua don't
build against it when the send feature is enabled.
Some upstream peers (e.g. QQ Mail's rate-limiter) silently hold a
proxied TCP connection open indefinitely — sending no data, FIN, or RST
— rather than cleanly refusing. Without some kind of timeout
management, the two file descriptors for such a session remain open for
the lifetime of the process, slowly exhausting the kernel's
file-descriptor table and occupying proxy-server worker slots.
This commit configures kernel level keepalive options with reasonable
defaults to detect and close out this class of connection.
Co-authored-by: Wez Furlong <wez@wezfurlong.org>
Closes: https://github.com/KumoCorp/kumomta/pull/509
import_headers takes an array of per-spec option tables, each describing
how a single header name or pattern should be imported into the message
metadata. Compared to import_x_headers it adds:
* Trailing-`*` wildcard patterns (e.g. `X-*`) alongside exact names.
Bare/leading/interior wildcards are rejected at compile time.
* `match` of `first`, `last` (default), or `all`. `all` captures every
matching header instance as an array of strings; the others capture
a string. Specs that produce no matches write nothing.
* `transform` selects the metadata key style: `snake_case` (default,
matches the existing import_x_headers behavior), `kebab_case`,
`camel_case`, or `pascal_case`. Header matching itself is always
case-insensitive.
* `target` overrides the metadata key for exact-name specs.
* `remove` strips the matched headers from the message body in a
single follow-up pass.
When more than one spec could match a header, the first matching spec
wins, so callers can place specific rules ahead of a wildcard catch-all.
import_x_headers now delegates to import_headers, so its behavior is
unchanged and the two share a single implementation.
retain_headers now passes the header index alongside the &Header to its
closure, which import_headers uses for its post-pass removal step
instead of tracking a parallel counter. Existing callers that don't
need the index ignore it with `_`.
Closes: #515
The `psl` crate's domain_str / suffix_str do byte-exact lookups against
the public-suffix list, so uppercase or trailing-dot inputs (e.g.
"Example.COM" or "example.com." from a DNS Name) silently return None.
Several call sites were passing through user- or DNS-supplied domains
unmodified.
Add a small psl-utils crate that wraps the psl crate:
* normalize_domain(&str) -> Cow<str>: strips a single trailing dot and
lowercases ASCII; borrows when the input is already normalized so
the hot path (alignment loop) doesn't allocate.
* domain_str / suffix_str: thin re-exports for callers that have
already normalized.
psl-utils becomes the only workspace crate that directly depends on
the psl crate; kumo-dmarc and mod-string switch to depending on
psl-utils instead.
Updated call sites:
* kumo-dmarc record.rs: is_relaxed_aligned / is_strict_aligned now
normalize both inputs first. Replaces the prior eq_ignore_ascii_case
comparisons.
* kumo-dmarc lib.rs: the organizational-domain fallback in
DmarcContext::check now normalizes from_domain before calling
domain_str and compares against the normalized form. Previously a
mixed-case From: header would skip the _dmarc.<org> lookup entirely.
* mod-string lib.rs: the Lua-exposed string.psl_domain and
string.psl_suffix bindings normalize their input. Behavior change:
inputs that previously returned nil due to case or trailing dot now
resolve.
Co-authored-by: Wez Furlong <wez@wezfurlong.org>
Closes: https://github.com/KumoCorp/kumomta/pull/513
Two bugs in the alignment logic added in the prior commit:
* auth_result_is_pass read auth_result.props["result"], but the
pass/fail status lives in the AuthenticationResult.result field.
Real callers don't populate a "result" key in props, so every DKIM
and SPF entry was treated as non-pass and skipped. Take
&AuthenticationResult and inspect .result directly.
* When no alignment succeeded and no per-method errors were recorded
(e.g. no DKIM signatures, SPF not pass), evaluate() fell through to
Disposition::Pass / "Success", silently passing unauthenticated
mail. Return the published policy disposition with context
"No aligned DKIM or SPF" instead.
Add regression tests dmarc_both_spf_and_dkim_fail_returns_fail (covers
the fall-through) and dmarc_dkim_relaxed_subdomain_reverse (relaxed
alignment when d= is a subdomain of From).
Wez Furlong
Mike Hillyer
Harsh JhaandWez Furlong
Aditya GantiandWez Furlong
kay ozakiandWez Furlong
Oleg Orekhov
dependabot[bot]
JackandWez Furlong