[gnu.org #1448007] Illegal command pipelining by lists.gnu.org (209.51.188.17)

[Ian Kelling via RT]

On Sat Nov 09 09:16:05 2019, address@hidden wrote:
> Hi, I ran into a problem while trying to subscribe to bug-gnu-emacs. My 
> subscription confirmations weren't coming through. I checked the mail 
> logs, and the root cause seems to be that lists.gnu.org (209.51.188.17)
> is being rejected by postfix's "postscreen_pipelining_enable = yes" 
> check, which looks for incorrect SMTP implementations. We have this 
> enabled on our MX to deter some spam bots.
> 
> The relevant feature is described at,
> 
>    http://www.postfix.org/POSTSCREEN_README.html#pipelining
> 
> And my logs for one of the sessions:
> 
>    Nov  9 08:18:19 mx1 postfix/postscreen[10830]: NOQUEUE: reject: RCPT
>    from [209.51.188.17]:40601: 450 4.3.2 Service currently unavailable;
>    from=<bug-gnu-emacs-bounces+michael=address@hidden>,
>    to=<address@hidden>, proto=ESMTP, helo=<lists.gnu.org>
> 
>    Nov  9 08:18:19 mx1 postfix/postscreen[10830]: COMMAND PIPELINING from
>    [209.51.188.17]:40601 after BDAT: Received: from localhost([::1]:36782
>    helo=lists1p.gnu.org)\r\n\tby lists.gnu.org with esmtp (Exim 4.90
> 
> This was fixed in Exim, it looks like,
> 
>    https://bugs.exim.org/show_bug.cgi?id=2454
> 
> but I wanted to prod you about upgrading because we can't turn that 
> feature off and you're probably dropping a significant chunk of mail due 
> to it.
> 
> 

I don't see any good config based workaround.

We are definitely not failing to send much mail due to this.  It was
added to postscreen in this commit:

commit 0f05229942fe2d11ab69bfa5a24faa7c8ae910b8
Author: Wietse Venema <address@hidden>
Date:   Sun Oct 13 00:00:00 2019 -0500

And it was fixed in exim more recently than that.

This is an non-default postscreen check according to its manual, and it
will fail for almost all exim servers since it affects the default
configuration and almost no one runs upstream development version of
exim. The configuration option in exim to disable this is
hosts_try_chunking, but it seems like that could cause more problems
than solve, it certainly has performance implications. Reasonable mail
server operators will not reject mail based on this check until long
term release distros have shipped the exim patch. I suggest using a
postscreen version which is slightly older or disabling this
check. Otherwise, you will be rejecting mail from lots of exim
servers. I could configure exim to not do chunking for just your mail
server, but I don't want to encourage unreasonable mail rejection.

-- 
Ian Kelling | Senior Systems Administrator, Free Software Foundation
GPG Key: B125 F60B 7B28 7FF6 A2B7  DF8F 170A F0E2 9542 95DF
https://fsf.org | https://gnu.org