SMTP submission: send as a shared mailbox with send-as

jcoffey-dev commented

2026-10-15 02:23:59 +00:00

Owner

A person allowed to send as a shared mailbox could only do it from the webmail (JMAP). Over SMTP the sender check knew only the login's own addresses and masks, so an app or service signed in as that person got 501 5.5.4 You are not allowed to send from this address. Found when the forum's mail stopped: community@ had been an alias on the hello@ shared mailbox, which can't have an app password.

What changes

MAIL FROM also accepts an address whose owner the login holds a current delegation with send-as into (shared mailbox or locked account). Exact address only, no catch-all.
MA-S3 over SMTP: a send as a shared mailbox is refused at DATA (550 5.7.1) when a From or Reply-To address isn't the mailbox's own, as JMAP refuses it.
MA-D0a / AL-9: a queued message sent as another account is audited (target QueuedMessage, "Sent as X, from "); a locked account's delegate gets the AL-9 record. SMTP sends as a group were not recorded before; now they are.
The SMTP session keeps the signed-in access token for this. audit_send_as is split so SMTP reuses its record.

Tests (RocksDB, local): account_lock_tests (its shared-mailbox part now sends as support@ over SMTP: delivered and audited; a foreign Reply-To refused; a desk without send-as still gets 501), audit_log_tests, smtp::inbound::auth, smtp::inbound::mail. cargo build -p inbuxa --locked, cargo test --workspace --locked --no-run and the fork checks pass.

No new UI strings. Docs: inbuxa.org PR to follow.

A person allowed to send as a shared mailbox could only do it from the webmail (JMAP). Over SMTP the sender check knew only the login's own addresses and masks, so an app or service signed in as that person got `501 5.5.4 You are not allowed to send from this address`. Found when the forum's mail stopped: community@ had been an alias on the hello@ shared mailbox, which can't have an app password. **What changes** - MAIL FROM also accepts an address whose owner the login holds a current delegation with send-as into (shared mailbox or locked account). Exact address only, no catch-all. - MA-S3 over SMTP: a send as a shared mailbox is refused at DATA (`550 5.7.1`) when a From or Reply-To address isn't the mailbox's own, as JMAP refuses it. - MA-D0a / AL-9: a queued message sent as another account is audited (target `QueuedMessage`, "Sent as X, from <login>"); a locked account's delegate gets the AL-9 record. SMTP sends as a group were not recorded before; now they are. - The SMTP session keeps the signed-in access token for this. `audit_send_as` is split so SMTP reuses its record. **Tests** (RocksDB, local): `account_lock_tests` (its shared-mailbox part now sends as support@ over SMTP: delivered and audited; a foreign Reply-To refused; a desk without send-as still gets 501), `audit_log_tests`, `smtp::inbound::auth`, `smtp::inbound::mail`. `cargo build -p inbuxa --locked`, `cargo test --workspace --locked --no-run` and the fork checks pass. No new UI strings. Docs: inbuxa.org PR to follow.

jcoffey-dev added 1 commit 2026-10-15 02:23:59 +00:00

SMTP submission: send as a shared mailbox with send-as

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 9m5s

Details

19108441b8

A delegate allowed to send as a shared mailbox (or a locked account
handed to it) could do so only through JMAP; over SMTP the sender check
knew only the login's own addresses and masks, so a service signed in
as a person got 501 5.5.4 for the mailbox's address.

- MAIL FROM also accepts an address whose owner the login holds a
  current delegation with sendAs into (exact address, no catch-all).
- MA-S3 over SMTP: a send as a shared mailbox is refused at DATA when a
  From or Reply-To address isn't the mailbox's own, as JMAP refuses it.
- MA-D0a / AL-9: a queued message sent as another account is audited
  (QueuedMessage target, "Sent as X, from <login>"); a locked account's
  delegate gets the AL-9 record. SMTP sends as a group, unrecorded
  before, are recorded the same way.
- The SMTP session keeps the signed-in AccessToken for this.

Tests: account_lock_tests' shared mailbox part sends as support@ over
SMTP (delivered, audited), is refused a foreign Reply-To, and a desk
without sendAs still gets 501.

jcoffey-dev merged commit 33aee0513e into main

2026-10-15 13:30:16 +00:00

jcoffey-dev deleted branch feat/smtp-send-as-delegation

2026-10-15 13:30:16 +00:00

jcoffey-dev referenced this pull request

2026-10-15 13:38:52 +00:00

Release 2026.10.15 #200

SMTP submission: send as a shared mailbox with send-as #199