[Baker]

Summary

The published image should obtain a certificate and start mail without a wrapper script, and a failure along the way should stay a failure instead of being reported as success.

• The entrypoint requests a Let's Encrypt certificate when Cloudflare DNS credentials are set, using devnull@localhost when no account email is provided. Issuance is skipped or allowed to fail without stopping SMTP. Empty or unreadable certificate files are not passed to the process. The Cloudflare token is removed from the environment before SMTP starts, and the process drops to the unprivileged user after writing /cert.
• SMTP shutdown and listeners: SIGTERM is handled before Serve blocks, a failed bind closes both listeners, and direct clients no longer wait out the PROXY header timeout for the 220 banner. A second MAIL FROM clears recipients from the aborted transaction. The recipient cap stays on the session, because go-smtp's own counter is not cleared when MAIL restarts a transaction.
• Authentication and delivery: a webhook redirect is not a successful delivery. Permanent SPF DNS errors stay permanent. DMARC relaxed alignment and policy lookup use the public suffix list, and only the From domain plus the organizational domain are queried. A DNS error during that lookup does not inherit a parent policy. Multiple From domains are a permanent error. MESSAGE_PROCESSING_TIMEOUT bounds SPF, DKIM, and DMARC. pct=0 is included in the DMARC JSON. Webhook metrics label the status with the numeric code.

Test plan

• go test -count=1 ./...
• Boot the image with CF_Token and CF_Zone_ID unset and confirm SMTP starts without STARTTLS
• Boot with a non-empty garbage file in /cert and confirm the process stays up without STARTTLS
• Boot with valid DNS credentials and confirm a certificate is issued, the token is absent from the SMTP process environment, and the process is not root
• Send SIGTERM to a running server and confirm it exits after the shutdown log
• Point the webhook at an endpoint that returns 302 and confirm SMTP does not answer 250
• Send a message whose From domain is a subdomain of a multi-label public suffix and confirm DMARC uses that organizational domain

Made with Cursor