How to debug delivery error "invalid peer certificate: NotValidForName"?

[jeanas]

Hi,

I've just installed a Stalwart mail server.

It receives emails sent to it fine, and IMAP is working. However, there are delivery errors when sending emails via SMTP -- but only with certain clients. Specifically, I'm able to send emails from this server to test email addresses I have at GMail, but it's not working when sending to my main address [email protected] . The log contains messages like these:

2023-08-12T17:51:44.555309Z  INFO delivery{id=17925046668 return_path="[email protected]" nrcpt=1 size=1618}:attempt{domain="abou-samra.fr" attempt_number=2}: smtp::outbound::delivery: context="tls" event="failed" mx="mx00.1and1.fr" error=TLS error: invalid peer certificate: NotValidForName
2023-08-12T17:51:44.555514Z  INFO delivery{id=17925046668 return_path="[email protected]" nrcpt=1 size=1618}: smtp::outbound::delivery: Delivery was not possible, message re-queued for delivery. context="queue" event="requeue" reason="delivery-incomplete"

I don't understand this error. Given that delivery to GMail works, I suppose the certificate problem is related to my personal email address, not to the Stalwart server itself. However, I don't see what could be going wrong, my address is hosted on a well-known provider (IONOS), and I don't have problems receiving emails from other people.

Any help?

[Darkspirit]

https://www.hardenize.com/report/abou-samra.fr/1691878284#email_certs
https://www.hardenize.com/report/abou-samra.fr/1691878284#email
The mail server's certificate is not valid for the MX record, but it must be.
You can fix it by changing the DNS MX records from

abou-samra.fr.          3596    IN      MX      10 mx01.1and1.fr.
abou-samra.fr.          3596    IN      MX      10 mx00.1and1.fr.

to

abou-samra.fr.          3596    IN      MX      10 mx01.kundenserver.de.
abou-samra.fr.          3596    IN      MX      10 mx00.kundenserver.de.

Please contact your hosting provider to let them know that they need to change it for all other customers as well because it's an EU GDPR requirement to have a correct mail server certificate:
https://mecsa.jrc.ec.europa.eu/en/
https://mecsa.jrc.ec.europa.eu/en/faq

[mdecimus]

Hi,

Just like @Darkspirit suggested, the problem is that the server certificate name does not match the hostname. You need to change the MX records to reflect the hostname specified in the TLS certificate.

Google is able to deliver because they are probably switching to plain text when the TLS upgrade fails.
Stalwart SMTP by default has stricter TLS settings, but it is possible to configure it to fall back to a plain text connection when TLS is unavailable. However this is probably not something you want.

[jeanas]

Thanks a lot! I fixed those MX records and all is fine now. I've also reported this to my hosting provider.