# Mail standards review · 0.1.6

**Release assessment:** the app supports a tested subset of mail access and delivery. A blanket RFC-conformance claim is not supported. This review covers the Rust app, the two Workers, the documented Postfix configuration and a private DNS/SMTP integration test. Public internet delivery and third-party client interoperability require separate evidence.

| Boundary | What the implementation does | Evidence and gaps |
|---|---|---|
| SMTP and MX | Postfix speaks SMTP and queues remote delivery in standalone mode. The Rust pipe records durable local delivery or accepts responsibility for a queued forward. Cloudflare terminates incoming SMTP on the tunnel installation. | The private lab exercises MX lookup at both hops, refuses third-party relay, and checks the stored original and forward-only spool cleanup. Test public TCP/25 reachability, multiple MX priorities, temporary DNS/SMTP errors, null reverse paths and the reserved postmaster address on the actual deployment. [RFC 5321 §§4.5, 5, 6](https://www.rfc-editor.org/rfc/rfc5321.html) |
| Responsibility after acceptance | The local database commits the message or forwarding job before acknowledging ingress. Repeated hand-off keys are deduplicated. Direct-forward payloads survive a failed or uncertain relay result. | **Open:** operator-visible failure state is not a sender delivery-status notification. Ingress KV records have no expiry and are deleted only after acknowledgment. The live rollout found no pending legacy expiring records. Failed and uncertain outbound submissions retain their payload for recovery. Sender notification, operator alerting and recovery workflows still require qualification. [RFC 5321 §§4.5.4, 6.1](https://www.rfc-editor.org/rfc/rfc5321.html#section-6.1) · [RFC 3464](https://www.rfc-editor.org/rfc/rfc3464.html) |
| Message syntax and MIME | Compose generates Date, From and Message-ID. UTF-8 subjects use encoded words and plain-text bodies use folded base64. Forwards wrap the original in message/rfc822. Forward retries reuse the same Message-ID. Encoded subject chunks are sized for the longer forwarding prefix. | Test corpus still needed for folded address groups, long trace headers, internationalized messages, malformed MIME and 8-bit transport through real relays. The input form supports ordinary ASCII addresses. Quoted local parts, address literals and SMTPUTF8 are outside the supported entry profile. [RFC 5322 §§2–3](https://www.rfc-editor.org/rfc/rfc5322.html) · [RFC 2046 §5.2.1](https://www.rfc-editor.org/rfc/rfc2046.html#section-5.2.1) · [RFC 2047 §2](https://www.rfc-editor.org/rfc/rfc2047.html#section-2) |
| Automatic messages | The forwarding wrapper identifies itself as automatic. Null-envelope senders, previously forwarded messages and automatic messages are excluded. The common explicit human-originated value Auto-Submitted: no is recognized. | Suppression is conservative on ambiguous, folded or overlong headers. Suppressed messages use ordinary inbox delivery and its quota. This is a local loop-prevention policy. [RFC 3834 §5](https://www.rfc-editor.org/rfc/rfc3834.html#section-5) |
| IMAP and authentication | The listener advertises IMAP4rev1 and AUTH=PLAIN on implicit TLS. Tests exercise login, mailbox selection, FETCH, flags, search, and literal handling. | NAS tests exercised 2.16 MB APPEND, supplied date and flags, byte-identical UID COPY, EXPUNGE announcements across two sessions, CLOSE, and quota and disk reclamation. Folder creation, removal and rename remain unavailable. The app does not advertise rev2 or the IMAP QUOTA extension. Check mandatory commands and responses against the advertised profile and run an independent interoperability suite before claiming full compliance. [RFC 3501](https://www.rfc-editor.org/rfc/rfc3501.html) · [RFC 9051](https://www.rfc-editor.org/rfc/rfc9051.html) · [RFC 8314](https://www.rfc-editor.org/rfc/rfc8314.html) |
| Public mail authentication | The forwarding wrapper uses the configured domain sender. SMTP TLS policy, signing, DNS records and recipient verification are administered by the selected relay. | The lab uses private DNS and plaintext SMTP confined to an internal network. It does not establish public certificate trust, domain alignment, DKIM, SPF, DMARC or provider deliverability. Test those with an independent receiving domain on a dedicated test subdomain. |

For exact IMAP behavior see [implementation deviations](DEVIATIONS.md). To reproduce the private delivery test see [the MX lab](../tests/mx-lab/README.md).