From 4b8ea03e7eddd8d6726ec5e24894a7d60a26927d Mon Sep 17 00:00:00 2001 From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com> Date: Sun, 5 Jul 2026 09:56:35 +0200 Subject: [PATCH] Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails --- CHANGELOG.md | 5 ++++- crates/common/src/network/mta.rs | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b11bd225..0777c1a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,10 +13,13 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If ## Fixed - DANE: Treat DNSSEC `bogus` as a temporary failures to prevent downgrade attacks. -- OIDC: `ECDSA` private key support for `SEC1` format. +- OIDC: + - `ECDSA` private key support for `SEC1` format. + - Allow ports in `redirect_uri` for loopback addresses. - PostgreSQL: Include error chain in error messages. - Prometheus: event counters are exported with incorrect metric names. - Registry: Changing the type of an existing account from `user` to `group` panics. +- Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails. ## [0.16.11] - 2026-06-25 diff --git a/crates/common/src/network/mta.rs b/crates/common/src/network/mta.rs index 7c4ed99e..f7f24142 100644 --- a/crates/common/src/network/mta.rs +++ b/crates/common/src/network/mta.rs @@ -76,14 +76,14 @@ impl Server { if self.is_enterprise_edition() && let Cow::Borrowed(addr) = &local_part && let Some(masked_id) = crate::enterprise::masked::MaskedAddress::parse(addr) - { - // Masked email resolution - return if let Some(masked_entry) = self + && let Some(masked_entry) = self .registry() .object::(Id::new(masked_id)) .await .caused_by(trc::location!())? - && masked_entry.enabled + { + // Masked email resolution + return if masked_entry.enabled && masked_entry .expires_at .is_none_or(|at| at.timestamp() > now() as i64)