Sorry I was ooo last week. Just deployed a change that should resolve this.
It looks like some mtas like mx1.logis.org and mx2.logis.org advertise STARTTLS but then silently stop responding to any TLS ClientHello larger than roughly 1,400 bytes, which ours crossed when KumoMTA's Rust TLS library (rustls) began offering a post-quantum key share, whose 1,216-byte key share pushed our hello to about 1,460–1,500 bytes, so every attempt hung until it timed out and the messages eventually expired in queue. I put in some automation so that when this happens we'll resort to OpenSSL, which sends a much smaller hello, instead of the Kumo rusttls library that was exceeding 1,400 bytes. But there is a chance it breaks again if openssl Let me know if you are still seeing any issues after about 6:00 PM EST Thanks, Alex -- Alexander Burch ActiveCampaign / Senior Deliverability Engineer [email protected] 1 North Dearborn St Suite 500, Chicago IL, 60602 <https://www.facebook.com/activecampaign> <http://www.twitter.com/activecampaign> <https://www.linkedin.com/company/activecampaign-inc-> <https://plus.google.com/107063868317743606466> <https://www.activecampaign.com/sig/?u=aburch&c=1> On Fri, Aug 7, 2026 at 12:20 PM Scott Q. <[email protected]> wrote: > We got the same update and incidentally today we started getting even more > reports of issues from Postmark... already sent the relevant details to > Alex. Scott On Friday, 07-08-2026 at 09:51 Brian Peterson via mailop wrote: > Was there any update on this? The latest I got from PostMark Support was > this > > <https://login-usb.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.PWi9Hna-Z13eMXwFv0NbrHZvtr_Tbh7Hy57wHfkHzUiysUSJsCCdEbT6C42sVO5kl68m3sv6JB915zIu020eT57IfG8zmojk7uD4KxENNgqh-3jJZCUVqdWsYhdBkNSk-aH-zqMxbku7fKFQj-PVK-fPGG4jNmP4V7XWmwJ_IXob1Eeoo98WhMa3mtmvvp6kp6H_VJuKd06d7hOLPLPIN8SlR9Fn-p-qMVvM7KuM_eWBEncNhpAZiR70PZTXtoQufniryuhY5LO7e2dlgxuTjxo4ztKeP9qHjFuWdrqVT9fOFBWcq7Rry3ETxYm-sZjm2r8KAGjKc0pEsO2_AZCl5g.iOcGYoZn0eAbPzAK.u8FtI9IT1cMTXe0d1zhFZds3uetGNH-QeYT-_7ghfJEGx7ZxSdSXxs02Qxqj-7phYZ2-87yM8mgZFcH8R4zscDQRgTH9glSPwzfdZyFTLfzwBYV2HX0fuH6X702hI9aQz1c1LdQ-dldi1iFlzVrlKJMEWM64IjNwBnpIg6LbUL1JhIVqOp_XzCt-OPC55BpUHEccLo0rxAlHtQdQb0m2shtGg679wecRzqOBd1co7BYOR7bYigUdBuZkdPir6SLUKLpMw6NpDMdq0tO7DecB3RpywRwBSA5bzFVWD-gcqxj1anFJpkMuDl5dQp1xiwGKpkhqDqlTMbNTTZA3kEksL7Wr_7L5_3lVvXL-TsE0rElOnnF9Hf61sYdcGDzII0lk9-0cFN9leIYMDVit0VXHQw34hdriv6HBc6zSKYn_4dknVrkdkbOZ2IqPAi0Uo_sgxhZp87Er4dtj38cyHBO_PMiZ6-kPhTwdFCVn.LVcvLhvBneqRyntj-xIRzg> > CGBANNERINDICATOR > > We got the same update and incidentally today we started getting even more > reports of issues from Postmark... already sent the relevant details to > Alex. > > Scott > > On Friday, 07-08-2026 at 09:51 Brian Peterson via mailop wrote: > > Was there any update on this? > > The latest I got from PostMark Support was this: (From Friday the 31st > 16:56 CST) > > " Here is a breakdown of what your firewall logs are telling us and why > everything changed around late May: > > 1. The May 22nd Changes & Rejected Connections You are spot on that > something changed in late May! Earlier this year, Postmark migrated our > underlying outbound mailing infrastructure to a new system called KumoMTA, > which is an open-source MTA built for high-volume sending environments. > This new system is highly concurrent and attempts to connect and deliver > messages much faster than our previous setup. The fact that the <vendor > redacted> email succeeded on May 1st makes perfect sense, as it was sent > before this upgrade was fully rolled out to those IPs." > > We've increased TLS connection limits on our end, but still no resolution. > > -Brian > > From: Alex Burch <[email protected]> > Sent: Thursday, July 30, 2026 11:18 AM > To: Brian Peterson <[email protected]> > Cc: Scott Q. <[email protected]>; [email protected] > Subject: Re: [mailop] Issues receiving from Postmark > > I am looking into this. I looks like we just have our TLS timeout set too > strictly and we'll be expanding it today. Feel free to message me directly > with any further issues or concerns regarding Postmark. > > > Thanks, > Alex > > -- > > > Alexander Burch > ActiveCampaign / Senior Deliverability Engineer > mailto:[email protected] > 1 North Dearborn St Suite 500, Chicago IL, 60602 > > > > > > On Wed, Jul 29, 2026 at 12:57 PM Brian Peterson via mailop <mailto: > [email protected]> wrote: > We’re seeing PostMark issues as well (Started maybe June or May?). Two > separate members of ours, using two separate app vendors, both of which > seem to use Postmark. The only info I have third hand is “Timed Out > waiting 5s for response to cmd=STARTTLS”. I can’t seem to find any > indication of rejected connections from Postmark on my end. Firewall > logging also shows all traffic flows allowed for the items that DO make it > through. > > Did you ever make any progress on your issue? Might these be related? (May > 22-24th also sticks out as to some sort of change made, but I’m not sure if > that was the app vendor or PostMark themselves.) > > > From: Scott Q. <mailto:[email protected]> > Sent: Wednesday, July 15, 2026 1:30 PM > To: mailto:[email protected] > Subject: [mailop] Issues receiving from Postmark > > If someone from Postmark is on the list..it seems we are having an issue > receiving e-mails from you. Only error customers report is: > smtp;400 KumoMTA internal: failed to connect to any candidate hosts: > connect to http://65.39.216.37:25 > <http://65.39.216.37:25> > and read initial banner: reading banner: Error Connection closed by peer > reading response to cmd=NONE > Sample e-mail: X-KumoRef: > eyJfQF8iOiJcXF8vIiwicmVjaXBpZW50IjoiY2hyaXNAaW5zdXJldGhlYm9hdC5jb20ifQ== > You can message me off-list - thank you! > Scott > _______________________________________________ > mailop mailing list > mailto:[email protected] > https://list.mailop.org/listinfo/mailop > <https://list.mailop.org/listinfo/mailop> > _______________________________________________ > mailop mailing list > [email protected] > https://list.mailop.org/listinfo/mailop > <https://list.mailop.org/listinfo/mailop> > >
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
