#1086178 sendmail: FEATURE(`sts') fails to validate some SANs, causing temp rejects

Package:
sendmail
Source:
sendmail
Submitter:
Bjørn Mork
Date:
2026-07-12 07:29:01 UTC
Severity:
normal
Tags:
#1086178#5
Date:
2024-10-28 12:38:49 UTC
From:
To:
I have been running with FEATURE(`sts') for a while, until I noticed
suspicious temporary failures like:

 reject=450 4.7.0 <redacted.redacted@outlook.com>... outlook-com.olc.protection.outlook.com not listed in SANs

There were also non-Microsoft examples, so this is not limited
to one certificate or receiver.  In any case, Microsoft is big
enough to be somewhat important ;-)

I took a look at the certificate and found a huge list of wildcards:

            X509v3 Subject Alternative Name:
                DNS:mail.protection.outlook.com, DNS:*.mail.eo.outlook.com, DNS:*.mail.protection.outlook.com, DNS:mail.messaging.microsoft.com, DNS:outlook.com, DNS:*.olc.protection.outlook.com, DNS:*.pamx1.hotmail.com, DNS:*.mail.protection.outlook.de, DNS:*.mx.microsoft, DNS:*.k-v1.mx.microsoft, DNS:*.n-v1.mx.microsoft, DNS:*.q-v1.mx.microsoft, DNS:*.y-v1.mx.microsoft, DNS:*.d-v1.mx.microsoft, DNS:*.e-v1.mx.microsoft, DNS:*.a-v1.mx.microsoft, DNS:*.r-v1.mx.microsoft, DNS:*.w-v1.mx.microsoft, DNS:*.p-v1.mx.microsoft, DNS:*.x-v1.mx.microsoft, DNS:*.j-v1.mx.microsoft, DNS:*.s-v1.mx.microsoft, DNS:*.c-v1.mx.microsoft, DNS:*.b-v1.mx.microsoft, DNS:*.f-v1.mx.microsoft, DNS:*.i-v1.mx.microsoft, DNS:*.t-v1.mx.microsoft, DNS:*.m-v1.mx.microsoft, DNS:*.o-v1.mx.microsoft, DNS:*.g-v1.mx.microsoft, DNS:*.v-v1.mx.microsoft, DNS:*.h-v1.mx.microsoft, DNS:*.l-v1.mx.microsoft, DNS:*.u-v1.mx.microsoft


Among those are *.olc.protection.outlook.com  So the
outlook-com.olc.protection.outlook.com MX should have matched.
There is something very fishy here.  Maybe wildcards don't work
at all?  Or maybe the problem is multiple wildcards in a single
certificate?

In any case, I have disabled STS for now.  And I suggest careful
log monitoring if you decide to enable this feature.



BjÃrn
#1086178#10
Date:
2024-10-28 16:28:19 UTC
From:
To:
Am 28.10.2024 um 12:38:49 Uhr schrieb Bjørn Mork:
postfix-sts-resolver, please start a discussion in comp.mail.sendmail.
If you don't have Usenet access, use this:
https://www.novabbs.com/computers/thread.php?group=comp.mail.sendmail
#1086178#15
Date:
2024-10-29 11:51:03 UTC
From:
To:
The attached patch fixes this issue for me.  It has been submitted
upstream to sendmail-YYYY (at) support.sendmail.org.  Don't know if
patches sent to address is tracked anywhere.


BjÃrn
#1086178#22
Date:
2024-10-30 08:45:41 UTC
From:
To:
Updated patch from  Claus Aßmann. This bug turned out to be known by upstream
and will be fixed in 8.18.2.


Bjørn
-----BEGIN PGP SIGNATURE-----

iGwEARECACwWIQR3fjfc8EF8nPbC0aDXSuqSjBsiyQUCZyHyNQ4cYmpvcm5AbW9y
ay5ubwAKCRDXSuqSjBsiySB6AJwMr4U7LmyYtRPEZv6s44cg9rLWPACghkekM2Wr
dCE/wHDJepryeF37Skg=
=rQ+7
-----END PGP SIGNATURE-----
#1086178#27
Date:
2026-07-12 07:12:37 UTC
From:
To:
Can that version be uploaded to trixie-backports, please?