Fix LDAP: Synchronize accounts when expanding mailing list recipients

CHANGELOG.md

@@ -84,6 +84,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - ACME: Update `defaultCertificateId` when renewing a certificate that is currently set as default.
 - Allow internal TLDs in e-mail addresses.
 - Websocket: Perform case insensitive matching during upgrade.
+- LDAP: Synchronize accounts when expanding mailing list recipients.
 
 ## [0.16.5] - 2026-05-11
 

crates/smtp/src/inbound/rcpt.rs

@@ -359,6 +359,29 @@ impl<T: SessionStream> Session<T> {
                 if !self.data.rcpt_to.contains(&member_addr)
                     && member_addr.address_lcase != list_addr.address_lcase
                 {
+                    // Force external directory synchronization
+                    if let Ok(Some(member_domain)) = self.server.domain(&member_addr.domain).await
+                        && self
+                            .server
+                            .get_directory_for_cached_domain(&member_domain)
+                            .is_some_and(|directory| directory.can_lookup_recipients())
+                        && matches!(
+                            self.server
+                                .account_id_from_email(&member_addr.address_lcase, false)
+                                .await,
+                            Ok(None)
+                        )
+                        && let Err(err) = self
+                            .server
+                            .rcpt_resolve(&member_addr.address_lcase, self.data.session_id)
+                            .await
+                    {
+                        trc::error!(
+                            err.span_id(self.data.session_id)
+                                .caused_by(trc::location!())
+                        );
+                    }
+
                     member_addr.dsn_info = orcpt.clone().into();
                     member_addr.flags = list_addr.flags;
                     self.data.rcpt_to.push(member_addr);

tests/src/system/tenant.rs

@@ -529,6 +529,7 @@ pub async fn test(test: &mut TestServer) {
                 sender_authenticated: true,
                 recipients: vec![IngestRecipient {
                     address: "user@tenantx.org".to_string(),
+                    orcpt: None,
                     is_spam: false
                 }],
                 message_blob: message_blob.clone(),
@@ -565,6 +566,7 @@ pub async fn test(test: &mut TestServer) {
                 sender_authenticated: true,
                 recipients: vec![IngestRecipient {
                     address: "user@tenantx.org".to_string(),
+                    orcpt: None,
                     is_spam: false
                 }],
                 message_blob,