0

Short:

When an e-mail message about to be send fails MTA-STS checks, it must not be delivered by design; will the sender be informed about the delivery failure? When?

Long & Background info:

When implementing mta-sts on custom domains to enforce the use of TLS connections, misconfigurations of the mta-sts.txt policy file (or a smtp-server not supporting TLS connections) will result in e-mail not being delivered as an enforced policy will require TLS connections to deliver the e-mail.

Via TLS-reporting the domain holder - not the sender - could be informed about any problems, provided TLS reporting is set-up to a different domain or tool that notifies on a different address than the domain in question.

My question is about any senders of e-mail messages. In a testcase with policy file mentioning incorrect mx records, no e-mails are delivered (as expected), but the test sender did not receive any messages about delivery problems (yet).

Is this expected behaviour? Or will the sender be informed after a number hours? If so, how many hours? - I ask because a delivery failure and NDR (non-delivery-reports) are usually returned instantly.

If a user misspelled an e-mail address or the receving server is down, the sender is informed about the trouble and can take action. Sometimes even the "delivery is delayed" is announced; not failed yet, but not delivered either.

I get the impression that the sender is not informed that a message is not delivered and is "silently blackholed / discarded". To be clear: that the message is not delivered is expected behaviour in this test case.

Spec: https://www.rfc-editor.org/rfc/rfc8461

Community
  • 1
  • 1
A71
  • 129
  • 7
  • 1
    According to [RFC 5321](https://tools.ietf.org/html/rfc5321#section-6.1) once a SMTP server accepts responsibility of an email message, it must not lose it but either deliver or return (bounce) it. – Robert May 07 '21 at 19:23
  • @Robert, thanks. I couldn't find straight forward answer in the RFC5321, some mentioning of time-windows from 1 to 3 days, but nothing concrete. Obviously it is a little older than mta ;). However, your main point, that it can only have two outcomes, helps. It also allows for testing. My first test resulted in a bounced message after 24 hours, but that was with non-existent server in mx records and correct mta file. So the error was about a DNS issue. For the next test round the mx dns record is not fake, just wrong server. I guess I will have the answer after the second round of tests. – A71 May 08 '21 at 23:58

1 Answers1

1

After running some testcases, I have experienced the following:

(This was done by a Outlook.com smtp server.)

Testcase C

  • MTA-STS: Deliberately incorrect, but existing third-party mx server in mta-sts file.
  • DNS: Correct mx server.

The sender was informed about the delivery failure after 24 hours.

It was explained in my local language what was going on; here information highlights:

  1. That the message could was not delivered.
  2. That it was tried multiple times to deliver.
  3. But that the cause was being unable to connect to the remote server.
  4. Advise was given to contact the recipient by phone to ask the recipient to inform the postmaster about the error.
  5. It was even suggested that the problem could most likely only be solved by the postmaster.
  6. (A link was provided but that wasn't really helpful. Additionally the technical bounce message was visible among it the technical words "failed MTA-STS validation").

Testcase B

  • MTA-STS: Correct and desired mx in mta-sts file.
  • DNS: Deliberately set to incorrect mx server, existing server though.

After 24 hours I received an error back. Confusingly the message state that the address did not exists in the target domain. Though this is true, it shouldn't have gotten this far. However, when reviewing the technical part the outlook-sending server mentioned 'failed mta-sts errors validation'. So the technical part contained the correct mta-sts validation error, but the human/user readable part only mentioned that the target address did not exist in the target server.

I guess if the address doesn't exists, any mta-sts errors are "less important" to report to the end-user. The user was advised to re-type and resend the e-mail and verify if the address with the recipient (phone was mentioned). However, even if the user followed the instructions, the next e-mail wouldn't have been delivered either, but that is beyond this testcase.

Testcase A

  • MTA-STS: Correct mx in mta-sts file.
  • DNS: Fake MX corrects.

After 24 hours I received an error back. The cause for not being able to deliver the message was being unable to resolve the domain location of the recipient. (Undesired result, but logical, mx were referring to nothing.)

The technical part of the message mentioned 'DNS query failed'. Nothing of mta-sts was mentioned.

Testcase Z (weird one)

  • MTA-STS: Correct mx in mta-sts file.
  • DNS: Incorrect but existing mx records; a cname referring to the same IP of the correct mx server (which shouldn't matter because mta-sts should compare cert with cname.)

The results, unexpected:

  • One email got delivered somewhere between that 24 time-window.
  • One email failed due to mta-sts validation error.

Temporary downtime of webserver might have been a factor, though that shouldn't have mattered. - Cannot explain.

Conclusion

I took a while to find the correct testcase as you can see. But Testcase C describes the desired behaviour. Yes, the sender is informed, after 24 hours with outlook.com as smtp-server. The user is informed in clear language. That being said, I do have an additional opinion about the timing here, mentioned below.

Limitations

Staying with the facts: I did not perform a testcase with a server trying unencrypted connections. Testcase C puts the ball into the the recipient's postmaster's court, I would be curious to see where the ball (the 'todo') would be placed, in the case of unencrypted attempts, as that cannot be solved by the recipient but must be solved by the sender or sender's postmaster.

I also did not test multiple smtp servers.

Further thoughts

That being said, MTA-STS-validation needs to be supported by the sender SMTP (correct me in comments if I am wrong*), so if a server is so old it tries do deliver an e-mail over non-encrypted connection, it will most likely not support MTA-STS so it will not validate the MTA-STS policy and simply deliver the e-mail unprotected. * Found confirmation here, from paragraph "There is a standard...")

If somebody tries to redirect some incoming e-mail by dns-poisoning, a modern smtp-server will not deliver the e-mail to an incorrect destination. So it protects against evil doing, not against legacy.

Opinion

I think the feedback delay of 24 hours is too long. Testcase C reports 11 retry attempts within that 24 hour window. Though I appreciate the system not giving up, I would argue that it might be in the interest of the sender to inform him of at least a non-regular delivery.

A71
  • 129
  • 7
  • [RFC 3464](https://datatracker.ietf.org/doc/html/rfc3464#section-2.3.3) says: After a few hours, [the MTA] might issue a "delayed" DSN to inform the sender that the message had not yet been delivered. After a few days, the MTA might abandon its attempt to deliver the message and return a "failed" DSN. So what you see is probably conformant. Email is not instant messaging :-) – Robert May 11 '21 at 16:46
  • @Robert ;) Maybe the e-mail itself is not instant messaging, however, error feedback should be quickly as possible. If an address is wrong, you get it back instantly. If mta-sts validation fails, I think you should get it back too, at least your mentioned "delayed" DSN, since the sender's normal expectation of delivery is broken. At least I am content that the sender is informed after 24 hours, as you know I initially got the impression that the sender would not get informed at all. – A71 May 11 '21 at 18:39
  • Maybe they wait until the DNS entry's time-to-lives expires? – Robert May 11 '21 at 19:42
  • Unlikely, during tests the DNS records had a TTL of 2 minutes. – A71 May 12 '21 at 09:42