Harden inbound SMTP production policy #11

Merged

ober merged 1 commit from security/prod-hardening into main

2026-08-21 12:03:10 -04:00

ober commented

2026-08-20 20:37:03 -04:00

Owner

Implements the production SMTP hardening plan across inbound policy, DNS-backed sender authentication, reputation checks, DKIM/DMARC, and larger validated DATA handling.

Highlights:

Fixes per-IP rate limiting and streaming DATA terminator handling.
Adds local-sender spoof rejection, strict HELO, RCPT failure limits, MAIL SIZE rejection, and VRFY hardening.
Adds TXT/PTR DNS support, SPF, DNSBL, FCrDNS, DKIM verification, and DMARC enforcement.
Prepends Received and Authentication-Results headers and enforces From/hop-count sanity.
Raises max_message_bytes default/ceiling to 35 MiB with host-side DATA validation above the WASM 64 KiB path.
Keeps outbound STARTTLS fail-closed because the current rustls client API does not expose verified STARTTLS upgrade of an existing SMTP socket.

Verification:

jerboa_verify on changed Scheme surfaces
make test
make binary
make release-evidence
jerboa_security_scan changed lines (remaining findings are test-only false positives)

Implements the production SMTP hardening plan across inbound policy, DNS-backed sender authentication, reputation checks, DKIM/DMARC, and larger validated DATA handling. Highlights: - Fixes per-IP rate limiting and streaming DATA terminator handling. - Adds local-sender spoof rejection, strict HELO, RCPT failure limits, MAIL SIZE rejection, and VRFY hardening. - Adds TXT/PTR DNS support, SPF, DNSBL, FCrDNS, DKIM verification, and DMARC enforcement. - Prepends Received and Authentication-Results headers and enforces From/hop-count sanity. - Raises max_message_bytes default/ceiling to 35 MiB with host-side DATA validation above the WASM 64 KiB path. - Keeps outbound STARTTLS fail-closed because the current rustls client API does not expose verified STARTTLS upgrade of an existing SMTP socket. Verification: - jerboa_verify on changed Scheme surfaces - make test - make binary - make release-evidence - jerboa_security_scan changed lines (remaining findings are test-only false positives)

ober added 1 commit

2026-08-20 20:37:03 -04:00