mail: defang hostnames Forward Email refuses before they cost the account (0.37.0) - #74
Merged
Merged
Conversation
…ount (0.37.0) Forward Email runs every hostname in an outbound message past Cloudflare's Family DNS and refuses the whole message when one is blocked (554 5.6.0 "Link hostname of bittorrented.com was detected by Cloudflare's Family DNS to contain adult-related content, phishing, and/or malware"). A bare mention counts, and a few refusals in a rolling window suspend the account's outbound queue until their support lifts it by hand, which is what happened to profullstack.com on 2026-09-13: the nightly nichedb report names our own torrent site. So before a message leaves through a forwardemail.net SMTP host, every hostname-shaped token in the subject, text and html is resolved at 1.1.1.3, and one that answers 0.0.0.0 is defanged in place (bittorrented[.]com). Addresses are left alone, at most 50 distinct hosts are looked up, and a host that does not resolve at all goes as written. stderr says which hosts were touched; --json carries them as `defanged`. Other providers are not checked, and Resend is not affected. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UpE2YNWeoYxtu2B8oL2LPS
ThreatCrush Security Scan13 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 5 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
On 2026-09-13 Forward Email suspended outbound SMTP for profullstack.com. The trusted source was Cloudflare Family DNS: a message that so much as mentioned
bittorrented.com(our own site, in a report line, not even a link) was refused with554 5.6.0 Link hostname of bittorrented.com was detected by Cloudflare's Family DNS to contain adult-related content, phishing, and/or malware, and enough refusals in their rolling window froze the whole queue. The nightly nichedb report goes out throughmail send, so the CLI has to protect the account rather than bounce after the fact.What
forwardemail.netSMTP host, every hostname-shaped token in the subject, text and html is resolved at1.1.1.3; one that answers0.0.0.0is defanged in place (bittorrented[.]com), longest name first sowww.x.comis handled beforex.comfinds its tail.--jsoncarries them asdefanged. Other SMTP providers are not checked, and Resend is unaffected.sendMail()takes anisBlockedcheck for tests; the real one isfamilyDnsBlockCheck().Checks
vitest run test/mail.test.ts: 75 pass (5 new).tsc --noEmitclean; eslint adds no warnings in the touched files.bittorrented.comandwww.bittorrented.comanswer as blocked at 1.1.1.3,nichedb.devdoes not.Version 0.36.1 → 0.37.0.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UpE2YNWeoYxtu2B8oL2LPS