Invalid server token on bounce mail

[ReptoxX]

Hello,

we're trying to get the bounce mails that occurr on our smtp relay.
When the message would be bounced our smtp provider tries to deliver a bounce message to our postal server which in return declines it's delivery with "invalid server token".
How would i now further troubleshoot the delivery of these mails?

Regards

[willpower232]

I presume you're seeing this error message

postal/app/lib/smtp_server/client.rb

Line 341 in fd3c7cc

"550 Invalid server token"

which implies that the domain on the email address that Postal is seeing is not one it is aware of, I'm not quite sure how to read that regex but are you generating the bounce message with an incorrect domain name or mangling whatever is sent by your smtp provider?

You could probably find the postal logs smtp for that time and see what was actually received by Postal

[ReptoxX]

The issue only occurs when the sending domain does not have a cname for a custom return path. That's when the default return path is used and that bounce failes to be delivered.

smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  <= EHLO hsmx01.antispameurope.com trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  => 250-My capabilities are trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  => 250 AUTH CRAM-MD5 PLAIN LOGIN trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  <= MAIL FROM:<> trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  => 250 OK trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  <= RCPT TO:<prvs=0149ed572d=ul9hqa@default-returnpath-domain> trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  => 550 Invalid server token trace_id=G620OTRO component=smtp-server
smtp-1  | 2025-03-03 09:21:05 +0000 DEBUG  <= QUIT trace_id=G620OTRO component=smtp-server

The default-returnpath-domain is checked to be correct.

Our SMTP Provider is handling that and i can't change it.

[willpower232]

Ah I didn't know Postal did that, annoying.

I did a couple of tests and I ended up with a UUID@default return path domain address which then means that this line fails

postal/app/lib/smtp_server/client.rb

Line 330 in fd3c7cc

if server = ::Server.where(token: uname).first

as the query to the database is for a token which is a different value.

I presume that the bug is Postal is using the wrong user part when the code can't confirm the outgoing domain properly.

What is also interesting is that one of my tests should have had a return path domain set but it was at the organisation level, not the server level so potentially there are two bugs here.

[ReptoxX]

You're right. The token is incorrect as the servers adds this prvs=0149ed572d= and postal can't find this token.
I don't know how to prevent that / fix it that he finds the token.

[ReptoxX]

I worked around that issue by adding the following line to the after the split.

uname = uname.split("=", 3)[-1]