[GH-ISSUE #622] Mailpit accepts RCPT TO with malformed source route syntax instead of rejecting it #389

New issue

Closed

opened 2026-03-15 14:11:44 +03:00 by kerem · 1 comment

kerem commented

2026-03-15 14:11:44 +03:00

Owner

Originally created by @rsingha108 on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/axllent/mailpit/issues/622

Description

Mailpit accepts an invalid RCPT TO address that includes a malformed source route (missing the required colon), returning 250 OK instead of rejecting the syntax error. This permits delivery attempts to an invalid recipient address and violates SMTP syntax handling per RFC 5321 §4.1.1.3.

Affected Version

v1.28

Steps to Reproduce

Ensure Mailpit is running on 127.0.0.1:8030 (docker image: axllent/mailpit:v1.28)
Connect to the SMTP port (e.g., telnet 127.0.0.1 8030).
Issue the following commands in order:

EHLO client.example
MAIL FROM:alice@example.com
RCPT TO:<@route.example user@example.com>

Observe the server’s response to the RCPT TO command.

Buggy Behavior

Mailpit responds “250 2.1.5 Ok” to RCPT TO:<@route.example user@example.com>, accepting a recipient address with an invalid source route syntax (missing the colon).

Expected Behavior

The server should reject the malformed recipient address with a 501 syntax error (e.g., “501 Syntax error in parameters or arguments”) because the source route is not correctly formed.
As per RFC 5321 [4.1.1.3]: "[4.1.1.3] Receiving systems MUST recognize source route syntax but SHOULD strip off the source route specification and utilize the domain name associated with the mailbox as if the source route had not been provided."

Originally created by @rsingha108 on GitHub (Jan 21, 2026). Original GitHub issue: https://github.com/axllent/mailpit/issues/622 ### Description Mailpit accepts an invalid RCPT TO address that includes a malformed source route (missing the required colon), returning 250 OK instead of rejecting the syntax error. This permits delivery attempts to an invalid recipient address and violates SMTP syntax handling per RFC 5321 §4.1.1.3. ### Affected Version v1.28 ### Steps to Reproduce 1. Ensure Mailpit is running on 127.0.0.1:8030 (docker image: axllent/mailpit:v1.28) 2. Connect to the SMTP port (e.g., telnet 127.0.0.1 8030). 3. Issue the following commands in order: - EHLO client.example - MAIL FROM:<alice@example.com> - RCPT TO:<@route.example user@example.com> 4. Observe the server’s response to the RCPT TO command. ### Buggy Behavior Mailpit responds “250 2.1.5 Ok” to RCPT TO:<@route.example user@example.com>, accepting a recipient address with an invalid source route syntax (missing the colon). ### Expected Behavior The server should reject the malformed recipient address with a 501 syntax error (e.g., “501 Syntax error in parameters or arguments”) because the source route is not correctly formed. As per RFC 5321 [4.1.1.3]: "[4.1.1.3] Receiving systems MUST recognize source route syntax but SHOULD strip off the source route specification and utilize the domain name associated with the mailbox as if the source route had not been provided."