Settings reload: no DNS at build time, don't refuse over old failures

A 3-node rehearsal found every settings reload refused, cluster-wide,
because one node couldn't resolve the Pyzor server:

- PyzorConfig::parse resolved the host while building the settings and
  made a failed lookup a build error. It now keeps the host and port and
  resolves when a message is checked (an IP address is used as is, a
  name is reused for five minutes, the lookup counts against the Pyzor
  timeout). A failure there is a Pyzor error for that message.
- A milter's hostname was resolved the same way, with a blocking
  to_socket_addrs in async code. An IP address is kept; a name is now
  resolved on each connection.

Other build-time I/O is already non-fatal: directories that can't
connect become unavailable with a warning (DIR-21), and the AI model
locality check only warns.

reload_registry swapped the core only when the whole build was free of
errors, while boot runs with whatever built. One failing object thus
refused every later reload, and the running settings went stale. Now a
reload is refused only for errors in objects that built when the
running settings were built (at boot or by the last applied reload):
applying it would lose those. Objects that already failed then are
missing from the running settings anyway, as at boot, so their errors
are logged and returned as known_errors but don't hold the reload back.
Refusing on new errors keeps a bad edit from taking a working object
out of service; the admin gets the error instead.

ReloadSettings now says "Settings were not reloaded." and names the
object and its error ("Tracer with id ...: Only one console tracer is
allowed"), with a count of any further errors. A refused reload after a
directory change logs its errors too.

system::reload::reload_tests (new): with Pyzor enabled on an
unresolvable host, ReloadSettings succeeds (on main it fails with
"Invalid address: failed to lookup address information"); an IP host
needs no lookup; a new build error refuses the reload, names the object
and leaves the running settings unchanged; the same error, once known
from the running settings' build, no longer blocks; once fixed, a new
error there blocks again. smtp::inbound::milter's session test now
names its milter "localhost", so the connect-time lookup is exercised.

crates/common/src/cache/reload.rs

@@ -20,13 +20,20 @@ use ahash::AHashMap;
 use directory::Directories;
 use registry::{
     schema::{prelude::ObjectType, structs::BlockedIp},
-    types::error::{Error, Warning},
+    types::{
+        error::{Error, Warning},
+        id::ObjectId,
+    },
 };
 use std::sync::Arc;
 use store::{LookupStores, registry::bootstrap::Bootstrap, write::now};
 
 pub struct ReloadResult {
+    /// Errors that kept the reload from being applied.
     pub errors: Vec<Error>,
+    /// inbuxa: errors in objects that already failed when the running
+    /// settings were built; logged, but they don't refuse a reload.
+    pub known_errors: Vec<Error>,
     pub warnings: Vec<Warning>,
     pub replaced_core: bool,
 }
@@ -114,42 +121,60 @@ impl Server {
                     directories: directory.directories,
                 };
 
-                // Parse tracers
+                // inbuxa: upstream swapped the core only when the whole build
+                // was free of errors, while boot runs with whatever built. So one
+                // object that failed (a DNS lookup that timed out, say) refused
+                // every later reload, cluster-wide when the reload came from
+                // ReloadSettings, and the running settings went stale. Now a
+                // reload is refused only for errors in objects that built when
+                // the running settings were built: those would be lost by
+                // applying it. Objects that already failed then are missing
+                // from the running settings anyway, as at boot, so their
+                // errors are reported but don't hold the reload back.
                 let tracers = Telemetry::parse(&mut bootstrap, &storage).await;
+                let core = Box::pin(Core::parse(&mut bootstrap, storage)).await;
+                let mut servers = Listeners::parse(&mut bootstrap).await;
 
-                if bootstrap.errors.is_empty() {
-                    let core = Box::pin(Core::parse(&mut bootstrap, storage)).await;
+                if !self.has_new_build_errors(&bootstrap.errors) {
+                    servers
+                        .parse_tcp_acceptors(&mut bootstrap, self.inner.clone())
+                        .await;
 
-                    if bootstrap.errors.is_empty() {
-                        let mut servers = Listeners::parse(&mut bootstrap).await;
-                        servers
-                            .parse_tcp_acceptors(&mut bootstrap, self.inner.clone())
-                            .await;
+                    if !self.has_new_build_errors(&bootstrap.errors) {
+                        // Update core
+                        self.inner.shared_core.store(core.into());
 
-                        if bootstrap.errors.is_empty() {
-                            // Update core
-                            self.inner.shared_core.store(core.into());
+                        // Update tracers
+                        tracers.update();
 
-                            // Update tracers
+                        // Reload queue settings
+                        self.inner
+                            .ipc
+                            .queue_tx
+                            .send(QueueEvent::ReloadSettings)
+                            .await
+                            .ok();
 
-                            tracers.update();
+                        self.record_build_errors(&bootstrap.errors);
 
-                            // Reload queue settings
-                            self.inner
-                                .ipc
-                                .queue_tx
-                                .send(QueueEvent::ReloadSettings)
-                                .await
-                                .ok();
-
-                            return Ok(ReloadResult {
-                                errors: bootstrap.errors,
-                                warnings: bootstrap.warnings,
-                                replaced_core: true,
-                            });
-                        }
+                        return Ok(ReloadResult {
+                            errors: Vec::new(),
+                            known_errors: bootstrap.errors,
+                            warnings: bootstrap.warnings,
+                            replaced_core: true,
+                        });
                     }
                 }
+
+                let (known_errors, errors) = std::mem::take(&mut bootstrap.errors)
+                    .into_iter()
+                    .partition(|error| self.is_known_build_error(error));
+                return Ok(ReloadResult {
+                    errors,
+                    known_errors,
+                    warnings: bootstrap.warnings,
+                    replaced_core: false,
+                });
             }
         }
 
@@ -163,7 +188,7 @@ impl ReloadResult {
     }
 
     pub fn log(&self) {
-        for error in &self.errors {
+        for error in self.errors.iter().chain(&self.known_errors) {
             error.log();
         }
         for warning in &self.warnings {
@@ -176,8 +201,34 @@ impl From<Bootstrap> for ReloadResult {
     fn from(bootstrap: Bootstrap) -> Self {
         Self {
             errors: bootstrap.errors,
+            known_errors: Vec::new(),
             warnings: bootstrap.warnings,
             replaced_core: false,
         }
     }
 }
+
+// inbuxa: which objects failed to build for the running settings
+impl Server {
+    /// Records the objects that failed to build for the settings now running.
+    pub fn record_build_errors(&self, errors: &[Error]) {
+        *self.inner.data.build_errors.lock() = errors.iter().filter_map(error_object).collect();
+    }
+
+    fn is_known_build_error(&self, error: &Error) -> bool {
+        error_object(error).is_some_and(|id| self.inner.data.build_errors.lock().contains(&id))
+    }
+
+    fn has_new_build_errors(&self, errors: &[Error]) -> bool {
+        errors.iter().any(|error| !self.is_known_build_error(error))
+    }
+}
+
+fn error_object(error: &Error) -> Option<ObjectId> {
+    match error {
+        Error::Validation { object_id, .. }
+        | Error::Build { object_id, .. }
+        | Error::NotFound { object_id } => Some(*object_id),
+        Error::Internal { object_id, .. } => *object_id,
+    }
+}

crates/common/src/config/inner.rs

@@ -96,6 +96,7 @@ impl Data {
             applications,
             logos: Default::default(),
             smtp_connectors: TlsConnectors::try_new().failed("Failed to build TLS connectors"),
+            build_errors: Default::default(),
             asn_geo_data: Default::default(),
         }
     }
@@ -237,6 +238,7 @@ impl Default for Data {
             applications: WebApplications::new(),
             logos: Default::default(),
             smtp_connectors: TlsConnectors::try_new().unwrap(),
+            build_errors: Default::default(),
             asn_geo_data: Default::default(),
             lookup_stores: Default::default(),
         }

crates/common/src/config/mailstore/spamfilter.rs

@@ -16,7 +16,6 @@ use mail_auth::common::resolver::ToReverseName;
 use nlp::classifier::model::{CcfhClassifier, FhClassifier};
 use registry::schema::{
     enums::{ExpressionVariable, ModelSize},
-    prelude::ObjectType,
     structs::{
         self, SpamDnsblServer, SpamDnsblSettings, SpamFileExtension, SpamPyzor, SpamRule,
         SpamSettings, SpamTag,
@@ -25,10 +24,10 @@ use registry::schema::{
 use sieve::SpamStatus;
 use std::{
     net::{IpAddr, SocketAddr},
-    time::Duration,
+    sync::Arc,
+    time::{Duration, Instant},
 };
 use store::registry::{RegistryObject, bootstrap::Bootstrap};
-use tokio::net::lookup_host;
 use utils::{cache::CacheItemWeight, glob::GlobMap};
 
 #[derive(rkyv::Archive, rkyv::Deserialize, rkyv::Serialize, Debug, Default)]
@@ -157,7 +156,11 @@ pub struct FtrlParameters {
 
 #[derive(Debug, Clone)]
 pub struct PyzorConfig {
-    pub address: SocketAddr,
+    // inbuxa: the server is resolved when a message is checked, not while the
+    // settings are built (see PyzorConfig::address)
+    pub host: String,
+    pub port: u16,
+    pub resolved: Arc<parking_lot::Mutex<Option<(SocketAddr, Instant)>>>,
     pub timeout: Duration,
     pub min_count: u64,
     pub min_wl_count: u64,
@@ -474,31 +477,15 @@ impl PyzorConfig {
             return None;
         }
 
-        let port = pyzor.port;
-        let host = pyzor.host;
-        let address = match lookup_host(format!("{host}:{port}"))
-            .await
-            .map(|mut a| a.next())
-        {
-            Ok(Some(address)) => address,
-            Ok(None) => {
-                bp.build_error(
-                    ObjectType::SpamPyzor.singleton(),
-                    "Invalid address: No addresses found.",
-                );
-                return None;
-            }
-            Err(err) => {
-                bp.build_error(
-                    ObjectType::SpamPyzor.singleton(),
-                    format!("Invalid address: {}", err),
-                );
-                return None;
-            }
-        };
-
+        // inbuxa: upstream resolved the host here and reported a failed lookup
+        // as a build error, so a DNS hiccup on one node refused every settings
+        // reload on it (and, from the node that ran ReloadSettings, across the
+        // cluster). The lookup now happens when a message is checked; a
+        // failure there is logged as a Pyzor error for that message.
         PyzorConfig {
-            address,
+            host: pyzor.host,
+            port: pyzor.port as u16,
+            resolved: Default::default(),
             timeout: pyzor.timeout.into_inner(),
             min_count: pyzor.block_count,
             min_wl_count: pyzor.allow_count,
@@ -508,6 +495,35 @@ impl PyzorConfig {
     }
 }
 
+// inbuxa: how long a resolved Pyzor address is reused
+const PYZOR_RESOLVE_TTL: Duration = Duration::from_secs(300);
+
+impl PyzorConfig {
+    /// The server's address: the host itself when it is an IP address,
+    /// otherwise the first address it resolves to, reused for five minutes.
+    pub async fn address(&self) -> std::io::Result<SocketAddr> {
+        if let Ok(ip) = self.host.parse::<IpAddr>() {
+            return Ok(SocketAddr::new(ip, self.port));
+        }
+        if let Some((address, resolved_at)) = *self.resolved.lock()
+            && resolved_at.elapsed() < PYZOR_RESOLVE_TTL
+        {
+            return Ok(address);
+        }
+        let address = tokio::net::lookup_host((self.host.as_str(), self.port))
+            .await?
+            .next()
+            .ok_or_else(|| {
+                std::io::Error::new(
+                    std::io::ErrorKind::NotFound,
+                    format!("{} has no addresses", self.host),
+                )
+            })?;
+        *self.resolved.lock() = Some((address, Instant::now()));
+        Ok(address)
+    }
+}
+
 impl ClassifierConfig {
     pub async fn parse(bp: &mut Bootstrap) -> Option<Self> {
         let classifier = bp.setting_infallible::<structs::SpamClassifier>().await;

crates/common/src/config/smtp/session.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use self::resolver::Policy;
@@ -22,7 +24,7 @@ use registry::schema::{
 };
 use smtp_proto::*;
 use std::{
-    net::{SocketAddr, ToSocketAddrs},
+    net::{IpAddr, SocketAddr},
     str::FromStr,
     time::Duration,
 };
@@ -384,19 +386,16 @@ impl SessionConfig {
                     Some(Milter {
                         enable: bp.compile_expr(id, &milter.ctx_enable()),
                         id,
-                        addrs: format!("{}:{}", milter.hostname, milter.port)
-                            .to_socket_addrs()
-                            .map_err(|err| {
-                                bp.build_error(
-                                    id,
-                                    format!(
-                                        "Unable to resolve milter hostname {}: {}",
-                                        milter.hostname, err
-                                    ),
-                                )
-                            })
-                            .ok()?
-                            .collect(),
+                        // inbuxa: upstream resolved the hostname here (a
+                        // blocking lookup) and made a failure a build error,
+                        // which refused the whole settings reload. An IP
+                        // address is kept as is; a name is resolved on each
+                        // connection (MilterClient::connect).
+                        addrs: milter
+                            .hostname
+                            .parse::<IpAddr>()
+                            .map(|ip| vec![SocketAddr::new(ip, milter.port as u16)])
+                            .unwrap_or_default(),
                         hostname: milter.hostname,
                         port: milter.port as u16,
                         timeout_connect: milter.timeout_connect.into_inner(),

crates/common/src/lib.rs

@@ -166,6 +166,10 @@ pub struct Data {
     pub logos: Mutex<AHashMap<Box<str>, LogoCache>>,
 
     pub smtp_connectors: TlsConnectors,
+
+    // inbuxa: the objects that failed to build when the running settings
+    // were built, at boot or by the last applied reload (see reload_registry)
+    pub build_errors: Mutex<AHashSet<registry::types::id::ObjectId>>,
 }
 
 #[derive(Clone)]

crates/common/src/manager/boot.rs

@@ -240,6 +240,9 @@ impl BootManager {
                     .parse_tcp_acceptors(&mut bootstrap, inner.clone())
                     .await;
 
+                // inbuxa: a reload isn't refused over objects that failed here
+                inner.build_server().record_build_errors(&bootstrap.errors);
+
                 BootManager {
                     inner,
                     bootstrap,

crates/jmap/src/registry/mapping/action.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use crate::registry::mapping::{RegistrySetResponse, map_bootstrap_error};
@@ -99,7 +101,7 @@ pub(crate) async fn action_set(
                 } else {
                     set.response
                         .not_created
-                        .append(id, map_bootstrap_error(result.errors));
+                        .append(id, reload_refused(result.errors));
                 }
             }
             Action::InvalidateCaches => {
@@ -573,3 +575,34 @@ async fn dmarc_troubleshoot(
 
     Some(request)
 }
+
+/// inbuxa: a refused reload names the object that stopped it and says the
+/// settings weren't applied; upstream passed on the first error's bare message
+/// ("Invalid address: ..."), which read like a problem with the request.
+fn reload_refused(errors: Vec<registry::types::error::Error>) -> SetError<Property> {
+    use registry::types::error::Error;
+    let more = errors.len().saturating_sub(1);
+    let mut description = match errors.first() {
+        Some(Error::Build { object_id, message }) => format!("{object_id}: {message}"),
+        Some(Error::Validation { object_id, errors }) => format!(
+            "{object_id}: {}",
+            errors
+                .iter()
+                .map(|err| err.to_string())
+                .collect::<Vec<_>>()
+                .join("; ")
+        ),
+        Some(Error::Internal {
+            object_id: Some(object_id),
+            error,
+        }) => format!("{object_id}: {error}"),
+        Some(Error::Internal { error, .. }) => error.to_string(),
+        Some(Error::NotFound { object_id }) => format!("{object_id} was not found"),
+        None => String::new(),
+    };
+    description.insert_str(0, "Settings were not reloaded. ");
+    if more > 0 {
+        description.push_str(&format!(" ({more} more in the server log.)"));
+    }
+    map_bootstrap_error(errors).with_description(description)
+}

crates/jmap/src/registry/set.rs

@@ -947,10 +947,14 @@ impl RegistrySet for Server {
                     self.cluster_broadcast(common::ipc::BroadcastEvent::RegistryChange(change))
                         .await;
                 }
-                Ok(_) => trc::event!(
-                    Registry(trc::RegistryEvent::BuildWarning),
-                    Details = "Settings didn't reload after a directory change",
-                ),
+                Ok(reload) => {
+                    // inbuxa: name what stopped it
+                    reload.log();
+                    trc::event!(
+                        Registry(trc::RegistryEvent::BuildWarning),
+                        Details = "Settings didn't reload after a directory change",
+                    )
+                }
                 Err(err) => {
                     trc::error!(err.details("Failed to reload directories"));
                 }

crates/smtp/src/inbound/milter/client.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use common::config::smtp::session::Milter;
@@ -25,7 +27,19 @@ impl MilterClient<TcpStream> {
     pub async fn connect(config: &Milter, session_id: u64) -> Result<Self> {
         tokio::time::timeout(config.timeout_command, async {
             let mut last_err = Error::Disconnected;
-            for addr in &config.addrs {
+            // inbuxa: a hostname is resolved here, per connection, rather
+            // than while the settings are built
+            let resolved;
+            let addrs = if config.addrs.is_empty() {
+                resolved = tokio::net::lookup_host((config.hostname.as_str(), config.port))
+                    .await
+                    .map_err(Error::Io)?
+                    .collect::<Vec<_>>();
+                &resolved
+            } else {
+                &config.addrs
+            };
+            for addr in addrs {
                 match TcpStream::connect(addr).await {
                     Ok(stream) => {
                         return Ok(MilterClient {

crates/spam-filter/src/modules/pyzor.rs

@@ -48,19 +48,24 @@ pub(crate) async fn pyzor_check(
     // Send message to address. inbuxa: in tests, a fixed table answers
     // instead of a public server (test_response).
     #[cfg(not(feature = "test_mode"))]
-    let response = pyzor_send_message(config.address, config.timeout, &request).await;
+    let response = match tokio::time::timeout(config.timeout, config.address()).await {
+        Ok(Ok(address)) => pyzor_send_message(address, config.timeout, &request).await,
+        Ok(Err(err)) => Err(err),
+        Err(_) => Err(std::io::Error::new(
+            std::io::ErrorKind::TimedOut,
+            "Timed out resolving the Pyzor server",
+        )),
+    };
     #[cfg(feature = "test_mode")]
     let response = std::io::Result::Ok(test_response(&request));
 
-    response
-        .map(Into::into)
-        .map_err(|err| {
-            trc::SpamEvent::PyzorError
-                .into_err()
-                .ctx(trc::Key::Url, config.address.to_string())
-                .reason(err)
-                .details("Pyzor failed")
-        })
+    response.map(Into::into).map_err(|err| {
+        trc::SpamEvent::PyzorError
+            .into_err()
+            .ctx(trc::Key::Url, format!("{}:{}", config.host, config.port))
+            .reason(err)
+            .details("Pyzor failed")
+    })
 }
 
 /// inbuxa: the answers tests get, by digest, instead of a public server's,