starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-25 00:46:03 +03:00

[GH-ISSUE #1419] Allowed characters in email addresses #1124

New issue

Open

opened 2026-02-27 11:15:24 +03:00 by kerem · 7 comments

kerem commented

2026-02-27 11:15:24 +03:00

Owner

Originally created by @ghost on GitHub (Mar 4, 2018).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1419

I've just been upgrading one of my dovecot servers and noticed the auth_username_chars settings in 10-auth.conf

# List of allowed characters in username. If the user-given username contains
# a character not listed in here, the login automatically fails. This is just
# an extra check to make sure user can't exploit any potential quote escaping
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
# set this value to empty.
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@

The default dovecot configuration means it's possible to create an account in Modoboa that a user can't login to ie úsér@example.com. This needs some research to see what is and isn't supported by Postfix and Dovecot then update Modoboa as required.

Has anyone encountered e-mail addresses containing unicode characters in the local part?

Django EmailValidator - used by Modoboa to check an e-mail address is valid
RFC 6530 Overview and Framework for Internationalized Email - proposed standard
Email address Internationalization

Originally created by @ghost on GitHub (Mar 4, 2018). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1419 I've just been upgrading one of my dovecot servers and noticed the `auth_username_chars` settings in `10-auth.conf` ``` # List of allowed characters in username. If the user-given username contains # a character not listed in here, the login automatically fails. This is just # an extra check to make sure user can't exploit any potential quote escaping # vulnerabilities with SQL/LDAP databases. If you want to allow all characters, # set this value to empty. #auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ ``` The default dovecot configuration means it's possible to create an account in Modoboa that a user can't login to ie `úsér@example.com`. This needs some research to see what is and isn't supported by Postfix and Dovecot then update Modoboa as required. Has anyone encountered e-mail addresses containing unicode characters in the local part? --- [Django EmailValidator](https://github.com/django/django/blob/5d4368cad39b79ae4ce2224c64facc72366d0fb8/django/core/validators.py#L173) - used by Modoboa to check an e-mail address is valid [RFC 6530 Overview and Framework for Internationalized Email](https://tools.ietf.org/html/rfc6530) - **proposed standard** [Email address Internationalization](https://en.wikipedia.org/wiki/Email_address#Internationalization)

kerem added the

enhancement

feedback-needed

question

labels

2026-02-27 11:15:24 +03:00

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 7, 2018):

@fyfe Yes, it's supported since postfix 3.0 and it should work with Modoboa too. (Look at SMTPUTF8 for example).

@tonioo commented on GitHub (Mar 7, 2018): @fyfe Yes, it's supported since postfix 3.0 and it should work with Modoboa too. (Look at SMTPUTF8 for example).

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@ghost commented on GitHub (Mar 24, 2018):

I should have been more specific, I'm more concerned about unicode characters in usernames. As the Dovecot configuration says by default it only allows ASCII characters in a username.

@ghost commented on GitHub (Mar 24, 2018): I should have been more specific, I'm more concerned about unicode characters in usernames. As the Dovecot configuration says by default it only allows ASCII characters in a username.

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@ghost commented on GitHub (Mar 26, 2018):

RE Postfix support looking at the Postfix documentation for SMTPUTF8 (see No automatic conversions between ASCII and UTF-8 domain names.) to properly support domain names containing Unicode charatcters lookup tables (i.e. virtual_mailbox_domains or virtual_alias_domains etc) need to list domains in Unicode (例.com) and ASCII (xn--fsq.com) format.

To support this a new field would need added to the Domain (and DomainAlias) model containing the punycoded (ASCII) version of the domain, and the Postfix maps would need updated to lookup the Unicode and ASCII versions of the domain.

I think at the moment we need a warning in the documentation saying that domains/usernames contaning unicode characters are not (fully) supported.

@ghost commented on GitHub (Mar 26, 2018): **RE Postfix support** looking at the [Postfix documentation for SMTPUTF8](http://www.postfix.org/SMTPUTF8_README.html) (see *No automatic conversions between ASCII and UTF-8 domain names.*) to properly support domain names containing Unicode charatcters lookup tables (i.e. `virtual_mailbox_domains` or `virtual_alias_domains` etc) need to list domains in Unicode (`例.com`) and ASCII (`xn--fsq.com`) format. To support this a new field would need added to the `Domain` (and `DomainAlias`) model containing the punycoded (ASCII) version of the domain, and the Postfix maps would need updated to lookup the Unicode and ASCII versions of the domain. --- I think at the moment we need a warning in the documentation saying that domains/usernames contaning unicode characters are not (fully) supported.

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@macuser913 commented on GitHub (May 30, 2018):

I second this feature request

@macuser913 commented on GitHub (May 30, 2018): I second this feature request

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@marchesM commented on GitHub (Mar 25, 2020):

This feature would be amazing, considering that internationalized domains are quite commons.
I have a use case that is bothering me:

setup an internationalized domain like: modoboà.com (xn--modobo-42.com)
the webmail through modoboa works just perfectly
setup the mailbox test@modoboà.com on gmail client on android
try to send an email
fails, postfix logs the following: warning: Illegal address syntax from unknown[IPV6_ADDRESS] in MAIL command: <test@modoboà.com>

I enabled the SMTPUTF8 on postfix following this:
http://www.postfix.org/SMTPUTF8_README.html
without this, you would get this in your postfix log:
warning: Illegal address syntax from unknown[IPV6_ADDRESS] in MAIL command: <test@modobo*??(.com>

right now it is impossible to properly email around with a domain that contains special characters

@marchesM commented on GitHub (Mar 25, 2020): This feature would be amazing, considering that internationalized domains are quite commons. I have a use case that is bothering me: * setup an internationalized domain like: modobo**à**.com (xn--modobo-42.com) * the webmail through modoboa works just perfectly * setup the mailbox test@modoboà.com on gmail client on android * try to send an email * fails, postfix logs the following: `warning: Illegal address syntax from unknown[IPV6_ADDRESS] in MAIL command: <test@modoboà.com>` I enabled the SMTPUTF8 on postfix following this: http://www.postfix.org/SMTPUTF8_README.html without this, you would get this in your postfix log: `warning: Illegal address syntax from unknown[IPV6_ADDRESS] in MAIL command: <test@modobo*??(.com>` right now it is impossible to properly email around with a domain that contains special characters

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@marchesM commented on GitHub (Mar 27, 2020):

I managed to fix all my issues with the following:

/etc/postfix/main.cf make sure you are using compatibility level 2, wasn't my case: compatibility_level = 2
/etc/postfix/main.cf disable the smtputf8 support: smtputf8_enable = no with this option i wasn't able to receive emails to my mailbox, I was getting status=undeliverable (mail for modoboà.com loops back to myself). Be careful, with this option set to no, I am not sure if emails will actually be delivered if you have unicode characters in the username.
when setting up an email client, make sure you are using the ponycode version of your domain: xn--modobo-42.com in EVERY fields you have to setup

so now I am able to:

receive emails sent from a gmail account through web gmail and android gmail app
send emails from user@modoboà.com through the gmail android app and the modoboa webmail

hope this will help others, but I doubt that my settings will persist through time since the utf8 support is still a hot topic

@marchesM commented on GitHub (Mar 27, 2020): I managed to fix all my issues with the following: - `/etc/postfix/main.cf` make sure you are using compatibility level 2, wasn't my case: `compatibility_level = 2` - `/etc/postfix/main.cf` disable the smtputf8 support: `smtputf8_enable = no` with this option i wasn't able to receive emails to my mailbox, I was getting `status=undeliverable (mail for modoboà.com loops back to myself)`. Be careful, with this option set to no, I am not sure if emails will actually be delivered if you have unicode characters in the username. - when setting up an email client, make sure you are using the ponycode version of your domain: xn--modobo-42.com in EVERY fields you have to setup so now I am able to: - receive emails sent from a gmail account through web gmail and android gmail app - send emails from user@modoboà.com through the gmail android app and the modoboa webmail hope this will help others, but I doubt that my settings will persist through time since the utf8 support is still a hot topic

kerem commented

2026-02-27 11:15:25 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 4, 2020):

@marchesM Do you use the ponycode version of your username to connect to the webmail?

@tonioo commented on GitHub (Dec 4, 2020): @marchesM Do you use the ponycode version of your username to connect to the webmail?

kerem referenced this issue

2026-02-27 12:09:32 +03:00

[PR #1124] [MERGED] Refacto/python3 #2129