#1120610 Inconsistent Parsing of Exclamation Mark in RCPT TO Address

Package:
postfix
Source:
postfix
Description:
High-performance mail transport agent
Submitter:
Wei-Cheng Wu
Date:
2025-11-13 04:07:02 UTC
Severity:
normal
#1120610#5
Date:
2025-11-13 04:05:34 UTC
From:
To:
Dear Maintainer,

I've discovered that Postfix handles two malformed RCPT TO addresses
inconsistently, which may have security and interoperability implications.

# Issue
Postfix treats these two malformed addresses differently when relaying:
RCPT TO:<u.com!>     ->   RCPT TO:<".com"@u>
RCPT TO:<u!.com>     ->   RCPT TO:<""@u.com>

Strictly speaking, both addresses violate RFC 5321 Section 4.1.2 because
they lack the required "@domain" component. Postfix rejects most other
queries without @domain, but does the above conversion when involving "!".


# Comparing with other MTAs
Exim will treat both these sequences as a local-part and forward with the
server's domain name appended (e.g. RCPT TO:<u.com!@exim.domain>).
Other MTAs we tested on do not have this feature in general and simply
reject these requests.