Masked emails: Return UnknownRecipient only for disabled or expired masked emails

CHANGELOG.md

@@ -13,10 +13,13 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 
 ## Fixed
 - DANE: Treat DNSSEC `bogus` as a temporary failures to prevent downgrade attacks.
-- OIDC: `ECDSA` private key support for `SEC1` format.
+- OIDC: 
+  - `ECDSA` private key support for `SEC1` format.
+  - Allow ports in `redirect_uri` for loopback addresses.
 - PostgreSQL: Include error chain in error messages.
 - Prometheus: event counters are exported with incorrect metric names.
 - Registry: Changing the type of an existing account from `user` to `group` panics.
+- Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails.
 
 ## [0.16.11] - 2026-06-25
 

crates/common/src/network/mta.rs

@@ -76,14 +76,14 @@ impl Server {
         if self.is_enterprise_edition()
             && let Cow::Borrowed(addr) = &local_part
             && let Some(masked_id) = crate::enterprise::masked::MaskedAddress::parse(addr)
-        {
-            // Masked email resolution
-            return if let Some(masked_entry) = self
+            && let Some(masked_entry) = self
                 .registry()
                 .object::<MaskedEmail>(Id::new(masked_id))
                 .await
                 .caused_by(trc::location!())?
-                && masked_entry.enabled
+        {
+            // Masked email resolution
+            return if masked_entry.enabled
                 && masked_entry
                     .expires_at
                     .is_none_or(|at| at.timestamp() > now() as i64)