Some gory details for the interested.

BLUF: If Odhiambo's message gets through, it's probably because his
MTA doesn't implement the sender side of MTA-STS.  mailmanlists.net
does implement the receiver side, and its configuration is too obscure
for me to verify that it works.

For the nerds/masochists: SMTP MTA Strict Transport Security
https://datatracker.ietf.org/doc/html/rfc8461

Brie Yoder via Mailman-Users writes:

 > 9/8/2026 4:31:59 AM - Server at 
 > MW4PR12MB8611.namprd12.prod.outlook.com<http://mw4pr12mb8611.namprd12.prod.outlook.com/>
 >  returned '550 5.4.317 Message expired, cannot connect to remote server(451 
 > 4.4.8 MX hosts of 'mailmanlists.net<http://mailmanlists.net/>' failed 
 > MTA-STS validation.)'

(Sorry for the long lines.)  That says "cannot connect ... failed
MTA-STS", which implies either the host is offline or there is a
network misconfiguration.  The "failed MTA-STS" seems likely to be a
Microsoft engineering brain bubble where the MTA-STS handler is
catching an error raised by the socket manager and emitting an
inaccurate message.  But this

 > 9/8/2026 4:21:59 AM - Server at mailmanlists.net<http://mailmanlists.net/> 
 > (0.0.0.0) returned '450 4.4.317 Cannot establish session with remote server 
 > [Message=451 4.4.8 MX hosts of 'mailmanlists.net<http://mailmanlists.net/>' 
 > failed MTA-STS validation.] 
 > [LastAttemptedServerName=mailmanlists.net<http://mailmanlists.net/>] 
 > [BL6PEPF0001E442.namprd02.prod.outlook.com<http://bl6pepf0001e442.namprd02.prod.outlook.com/>
 >  2026-09-08T04:21:59.309Z 08DF0B0055FEBFFE](451 4.4.8 MX hosts of 
 > 'mailmanlists.net<http://mailmanlists.net/>' failed MTA-STS validation.)'

says "cannot establish session ... failed MTA-STS."  That does suggest
an issue with host configuration at mailmanlists.net.  They do have
MTA-STS configured in their DNS, which might be causing the problem.
It's complicated with a lot of aliasing and eventual delegation to
tutanota.com (!), and there's no visible alias in the DNS connecting
the policy-specified MX to mailmanlists.net.

Steve

-- 
GNU Mailman consultant (installation, migration, customization)
Sirius Open Source    https://www.siriusopensource.com/
Software systems consulting in Europe, North America, and Japan
------------------------------------------------------
Mailman-Users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/mailman-users.python.org/
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: https://www.mail-archive.com/[email protected]/
    https://mail.python.org/archives/list/[email protected]/
Member address: [email protected]

Reply via email to