RFC 3974
SMTP Operational Experience in Mixed IPv4/v6 Environments
RFC 3974: SMTP Operational Experience in Mixed IPv4/v6 Environments 💌
okay bestie, this one is RFC 3974 and it's all about how email still gets delivered when some servers only speak IPv4, some only speak IPv6, and some do both 📬✨
Quick title block tea ☕: it's Informational, dated January 2005, and it's by M. Nakamura (Kyoto University) and J. Hagino (IIJ Research Laboratory). It's numbered 3974, and the header doesn't say it obsoletes or updates any other RFC 🎀
Status of This Memo ✨
this is information for the internet community 🌸 It is not an Internet standard of any kind, and distribution is unlimited 💖
Copyright Notice 📜
Copyright (C) The Internet Society (2005) 💜
IESG Note 📣
bestie, read this part carefully 🙈 The content was once considered by the IETF, so it might look like a current IETF work in progress or a published IETF work. This RFC is not a candidate for any level of Internet Standard. The IETF doesn't know whether it's fit for any purpose, and the decision to publish wasn't based on IETF review for things like security, congestion control, or messing with deployed protocols. The RFC Editor chose to publish it at its discretion, so readers should be careful about how much they trust it before implementing or deploying anything 🔥
This document has a specific take on how the MX processing algorithm in RFC 2821, Section 5, applies to dual-stack environments. Implementors have been warned that they must reference RFC 2821 for the full algorithm. This document is not a full restatement of RFC 2821, and if anything is ambiguous, RFC 2821 wins 👑
Abstract ✨
so this document talks about SMTP operational experiences in IPv4/v6 dual stack environments 🦋 As IPv6-capable SMTP servers roll out, it's become clear that certain MX record configurations are needed for stable dual-stack (IPv4 and IPv6) SMTP operation. It clears up the existing problems during the transition from IPv4 SMTP to IPv6 SMTP, and it defines operational requirements for stable IPv4/v6 SMTP operation 🧚
This document does not define any new protocol 🙅♀️
1. Introduction ✨
okay so mail doesn't always go straight from the sender to the final receiver 📮 Sometimes there are intermediate hosts that relay the messages, which means it's really hard to know, at submission time (or on the receiver's side), that every relay is set up correctly 😭 Configuring everything consistently is tough because the DNS setup used by mail delivery is more complicated than other Internet services. During the IPv4-to-IPv6 transition, you need to be extra careful about IPv4/v6 interoperability 💅
This document is about SMTP operational experiences in IPv4/v6 dual stack environments 🌈 As IPv6-capable SMTP servers get deployed, it's become obvious that certain MX record configurations are needed for stable dual-stack (IPv4 and IPv6) SMTP operation 💖
This document does not discuss what happens when the sending MTA and the receiving MTA have no protocol in common, like when the sender is IPv4-only and the receiver is IPv6-only 🙈 That situation can be fixed by making either side dual-stack, or by making either side use a protocol translator (see Appendix A on issues with protocol translator) 🫶
2. Basic DNS Resource Record Definitions for Mail Routing 📬
mail on the Internet usually gets delivered using the Domain Name System [Mockapetris] 🌸 MX RRs get looked up in DNS to find the names of hosts running MTAs for the domain part of the mail address. DNS lookups use the IN class for both IPv4 and IPv6, so IN MX records are used for mail routing on both. Hosts that have IPv6 connectivity and want mail delivered over IPv6 need IPv6 addresses for the host name, as well as IPv4 addresses [Thomson] 💜
An MX RR has two parameters: a preference value and the name of the destination host. That destination host name is used to look up an IP address for starting an SMTP connection [Partridge] ✨
For example, an IPv6-only site might have these DNS definitions:
example.org. IN MX 1 mx1.example.org.
IN MX 10 mx10.example.org.
mx1.example.org. IN AAAA 2001:db8:ffff::1
mx10.example.org. IN AAAA 2001:db8:ffff::2During the IPv4-to-IPv6 transition there are lots of IPv4-only sites, and those sites won't have mail interoperability with IPv6-only sites 😭 So for the transition period, every mail domain should have MX records where the MX targets have both IPv4 and IPv6 addresses, like this:
example.org. IN MX 1 mx1.example.org.
IN MX 10 mx10.example.org.
mx1.example.org. IN AAAA 2001:db8:ffff::1
IN A 192.0.2.1
mx10.example.org. IN AAAA 2001:db8:ffff::2
IN A 192.0.2.2But not every MX target can run dual-stack, and some host entries only have A RRs or AAAA RRs 🥺
example.org. IN MX 1 mx1.example.org.
IN MX 10 mx10.example.org.
mx1.example.org. IN AAAA 2001:db8:ffff::1
mx10.example.org. IN A 192.0.2.1Next up: section 3 covers how the sender side should handle combined IPv4/v6 RRs, and section 4 covers how the receiver should define RRs so IPv4 and IPv6 networks stay interoperable 🦋
3. SMTP Sender Algorithm in a Dual-Stack Environment 🎀
in a dual-stack environment, the MX records for a domain look something like this:
example.org. IN MX 1 mx1.example.org.
IN MX 10 mx10.example.org.
mx1.example.org. IN A 192.0.2.1 ; dual-stack
IN AAAA 2001:db8:ffff::1
mx10.example.org. IN AAAA 2001:db8:ffff::2 ; IPv6-onlyFor a single MX record, there are several possible final states: (a) one or more A records for the IPv4 destination, (b) one or more AAAA records for the IPv6 destination, or (c) a mix of A and AAAA records. Since multiple MX records can have different preference values, multiple addresses have to be traversed across multiple MXs. Domains without MX records and failure recovery cases also need to be handled properly 💅
The dual-stack SMTP sender algorithm is basically the same as the IPv4-only one, except it now includes AAAA lookups of MX records for SMTP-over-IPv6 delivery ✨ IPv4/v6 dual stack destinations should be treated just like multihomed destinations, as described in RFC 2821 [Klensin], section 5. If no destination address record is found (so the sender MTA is IPv4-only and there are no A records available), the case should be handled just like MX records without address records, and deliveries should fail 😭
; if the sender MTA is IPv4-only, email delivery to a.example.org
; should fail with the same error as deliveries to b.example.org.
a.example.org. IN MX 1 mx1.a.example.org.
mx1.a.example.org. IN AAAA 2001:db8:ffff::1 ; IPv6-only
b.example.org. IN MX 1 mx1.b.example.org. ; no addressHere's the algorithm for a dual-stack SMTP sender 🔥
(1) Look up the MX record for the destination domain. If a CNAME record comes back, go back to the top of step (1), replacing the destination domain with the query's result. If any MX records come back, go to step (2) with the query's result (explicit MX). If NODATA comes back (an empty answer with NOERROR(0) RCODE), there's no MX record but the name is valid. Assume there's a record like "name. IN MX 0 name." (implicit MX) and go to step (3). If HOST_NOT_FOUND comes back (an empty answer with NXDOMAIN(3) RCODE), there's no such domain, so raise a permanent email delivery failure and finish. If SERVFAIL comes back, retry after a certain period of time 💀
(2) Compare each host name in the MX records with the names of the sending host. If there's a match, drop the MX records that have an equal or larger value than the lowest-preference matching MX record (including itself). If multiple MX records remain, sort them in ascending order by their preference values. Loop over steps (3) to (9) on each host name in the MX records, in sequence. If no MX records remain, the sending host must be the primary MX host, and other routing rules should be applied. Finish 🌸
(3) If the sending MTA has IPv4 capability, look up the A records. Keep the resulting addresses until step (5) 💖
(4) If the sending MTA has IPv6 capability, look up the AAAA records 🧚
NOTE: IPv6 addresses for hosts defined by MX records may be included in an additional information section of the DNS query results, just like IPv4 addresses. If there's no additional address information for the MX hosts, separate queries for A or AAAA records should be sent. There's no way to query A and AAAA records at once in the current DNS implementation 🙈
(5) If there's no A record and no AAAA record present, try the next MX record (go to step (3)). Note that the next MX record could have the same preference 🫶
NOTE: If one or more address records are found, an implementation may sort the addresses based on its own preference for A or AAAA records. To encourage the transition from IPv4 SMTP to IPv6 SMTP, AAAA records should take precedence. The sorting may only reorder addresses from MX records of the same preference. RFC 2821 section 5 paragraph 4 suggests randomizing destination addresses. Randomization should only happen among A records, and among AAAA records (do not mix A and AAAA records) 🌈
(6) For each of the addresses, loop over steps (7) to (9) ✨
(7) Try to make a TCP connection to the destination's SMTP port (25). The client needs to follow the timeouts documented in RFC 2821 section 4.5.3.2. If it succeeds, go to step (9) 🦋
(8) If it's unsuccessful and there's another available address, try the next available address and go to step (7). If all addresses are unreachable and a list of MX records is being traversed, try the next MX record (go to step (3)). If there's no list of MX records, or the end of the list has already been reached, raise a temporary email delivery failure and finish 😭
(9) Attempt to deliver the email over the established connection, as specified in RFC 2821. If a transient failure condition is reported, try the next MX record (go to step (3)). If an error condition is reported, raise a permanent email delivery error and don't try any further MX records. Finish. If it succeeds, SMTP delivery has succeeded, and you're done 🎉
4. MX Configuration in the Recipient Domain 💌
4.1. Ensuring Reachability for Both Protocol Versions 🌟
if a site has dual-stack reachability, it should configure both A and AAAA records for its MX hosts (NOTE: MX hosts can be outside of the site). This helps both IPv4 and IPv6 senders reach the site efficiently 💖
4.2. Reachability Between the Primary and Secondary MX 🌸
okay so when you're setting up MX records in a dual-stack setup, you have to think about whether the MX hosts can actually reach each other 🧐 this part is lowkey the most important thing in the whole section. Say all your inbound email is supposed to land on the primary MX host, "mx1.example.org.":
example.org. IN MX 1 mx1.example.org.
IN MX 10 mx10.example.org.
IN MX 100 mx100.example.org.Now imagine mx1 is IPv6-only and the others are IPv4-only 💀 then there's no way for the primary and the other MX hosts to reach each other at all. When email lands on one of the lower-preference MX hosts, it can't get relayed up to the primary through the MX preference mechanism. So mx1 won't be able to collect all the emails, unless there's some other transport between the lower-preference MX hosts and mx1. Not a vibe.
; This configuration is troublesome.
; No secondary MX can reach mx1.example.org.
example.org. IN MX 1 mx1.example.org. ; IPv6-only
IN MX 10 mx10.example.org. ; IPv4-only
IN MX 100 mx100.example.org. ; IPv4-onlyThe easiest fix is making the primary MX host a dual-stack node 🫶 once it's dual-stack, the secondary MX hosts have no problem reaching it, and everything just flows.
; This configuration works well.
; The secondary MX hosts are able to relay email to the primary MX
; host without any problems.
example.org. IN MX 1 mx1.example.org. ; dual-stack
IN MX 10 mx10.example.org. ; IPv4-only
IN MX 100 mx100.example.org. ; IPv6-onlyHere's the plot twist 🦋 the primary and lower-preference MX hosts don't always need to talk to each other directly over IPv4 or IPv6. You could set up a routing path with UUCP, or use an IPv4/v6 translator. Or you could drop messages into one shared mailbox using NFS, or something else a dual-stack server offers. Either way, it's the receiver site's job to make sure every message delivered to the MX hosts actually shows up in the recipient's mail drop. In setups like these, a dual-stack MX host might not even need to be listed in the MX list. iykyk 😌
5. Operational Experience ✨
Lots of the existing IPv6-ready MTAs seem to work the way section 3 describes 💅
BUT 😭 there were cases where IPv6-ready MTAs got confused by broken DNS servers. When an MTA tries to get a canonical hostname, some of these broken name servers return SERVFAIL (RCODE 2), which is a temporary failure on AAAA record lookups. When that happens, the email just gets queued for a later attempt. For the sake of IPv4/v6 interoperability, these broken DNS servers should be fixed 🔧 If you want more detail on misconfigured or misbehaving DNS servers and the negative side effects they cause, there's a document by Yasuhiro Morishita [Morishita] that goes into it.
6. Open Issues 🌈
- How should scoped addresses (i.e., link-local addresses) in email addresses be interpreted on MTA's? We suggest prohibiting the use of IPv6 address literals in destination specification.
- A future specification of SMTP (revision of RFC 2821) should be updated to include IPv6 concerns presented in this memo, such as (1) the additional query of AAAA RRs where A RRs and/or MX RRs are suggested, and (2) the ordering between IPv6 destination and IPv4 destination.
7. Security Considerations 💀
⚠️ This one is serious, bestie. It could be problematic if the route-addr email address format [Crocker] (or "obs-route" address format in [Resnick]) is used across multiple scope zones. MTAs would need to reject email with route-addr email address formats that cross scope zone borders. Don't let this one slide 🚫
Appendix A. Considerations on Translators 🧚
IPv6-only MTA to IPv4-only MTA cases could use help from IPv6-to-IPv4 translators such as [Hagino]. Normally, no special SMTP considerations are needed for translators. If there's SMTP traffic from an IPv6 MTA to an IPv4 MTA over an IPv6-to-IPv4 translator, the IPv4 MTA will just treat it as normal IPv4 SMTP traffic.
Protocols like IDENT [St.Johns] may need special consideration when translators are used. Also, some MTAs do strict checks on the SMTP HELO/EHLO "domain" parameter (they do reverse/forward DNS lookups and check whether the "domain" really associates with the SMTP client's IP address). In that case, you need special consideration when translators are in use (for instance, overriding the "domain" parameter with the translator's FQDN/address) 🙈
Even without a translator, there seem to be some MTA implementations out in the wild that send IPv6 address literals in a HELO/EHLO message (like "HELO [IPv6:blah]"), even when they're using IPv4 transport, or the other way around. If the SMTP peer is IPv4-only, it won't understand the "[IPv6:blah]" syntax, and mails won't go out of the (broken) MTA. These implementations have to be corrected 😤
Normative References 📚
[Mockapetris] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[Thomson] Thomson, S., Huitema, C., Ksinant, V., and M. Souissi,
"DNS Extensions to Support IP Version 6", RFC 3596,
October 2003.
[Partridge] Partridge, C., "Mail routing and the domain system",
STD 10, RFC 974, January 1986.
[Klensin] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821,
April 2001.
[Crocker] Crocker, D., "Standard for the format of ARPA Internet
text messages", STD 11, RFC 822, August 1982.
[Resnick] Resnick, P., "Internet Message Format", RFC 2822, April
2001.
[Hagino] Hagino, J. and H. Snyder, "IPv6 Multihoming Support at
Site Exit Routers", RFC 3178, October 2001.
[St.Johns] Johns, M. St., "Identification Protocol", RFC 1413,
February 1993.Informative References 🦋
[Morishita] Morishita, Y. and T. Jinmei, "Common Misbehavior
against DNS Queries for IPv6 Addresses", Work in
Progress, June 2003.Acknowledgements 💖
This document was written based on discussions with Japanese IPv6 users and help from the WIDE research group. Here is a (probably incomplete) list of people who contributed to the document: Gregory Neil Shapiro, Arnt Gulbrandsen, Mohsen Souissi, JJ Behrens, John C Klensin, Michael A. Patton, Robert Elz, Dean Strik, Pekka Savola, and Rob Austein. Thank you all, you're the real ones 🫶
Authors' Addresses ✨
Motonori NAKAMURA
Academic Center for Computing and Media Studies, Kyoto University
Yoshida-honmachi, Sakyo, Kyoto 606-8501, JAPAN
Fax: +81-75-753-7450
EMail: motonori@media.kyoto-u.ac.jp
Jun-ichiro itojun HAGINO
Research Laboratory, Internet Initiative Japan Inc.
1-105, Kanda Jinbo-cho,
Chiyoda-ku,Tokyo 101-0051, JAPAN
Phone: +81-3-5205-6464
Fax: +81-3-5205-6466
EMail: itojun@iijlab.netFull Copyright Statement ©
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and at www.rfc-editor.org, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔥
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the ISOC's procedures with respect to rights in ISOC Documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 👑
Funding for the RFC Editor function is currently provided by the Internet Society. ✨ And that's a wrap on RFC 3974, periodt 💅🦋
📦 where this page comes from
- ietf: rfc3974 2005-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms