Thanks Alex,
* I have one member indicating things got better around 9:06 AM CST on the 11th. (I’ve also been out the last 3 days) * I’ve forwarded this info to Cisco TAC. Perhaps they can provide an update or fix. * I may update this listing once I confirm the other 2 members are also working better. -Brian From: Alex Burch <[email protected]> Sent: Monday, August 10, 2026 5:18 PM To: Scott Q. <[email protected]> Cc: Brian Peterson <[email protected]>; [email protected] Subject: Re: [mailop] Issues receiving from Postmark Sorry I was ooo last week. Just deployed a change that should resolve this. It looks like some mtas like mx1.logis.org<http://mx1.logis.org> and mx2.logis.org<http://mx2.logis.org> advertise STARTTLS but then silently stop responding to any TLS ClientHello larger than roughly 1,400 bytes, which ours crossed when KumoMTA's Rust TLS library (rustls) began offering a post-quantum key share, whose 1,216-byte key share pushed our hello to about 1,460–1,500 bytes, so every attempt hung until it timed out and the messages eventually expired in queue. I put in some automation so that when this happens we'll resort to OpenSSL, which sends a much smaller hello, instead of the Kumo rusttls library that was exceeding 1,400 bytes. But there is a chance it breaks again if openssl Let me know if you are still seeing any issues after about 6:00 PM EST Thanks, Alex -- [Image removed by sender.] Alexander Burch ActiveCampaign / Senior Deliverability Engineer [email protected]<mailto:[email protected]> 1 North Dearborn St Suite 500, Chicago IL, 60602 [Image removed by sender.]<https://www.facebook.com/activecampaign> [Image removed by sender.] <http://www.twitter.com/activecampaign> [Image removed by sender.] <https://www.linkedin.com/company/activecampaign-inc-> [Image removed by sender.] <https://plus.google.com/107063868317743606466> [Image removed by sender.]<https://www.activecampaign.com/sig/?u=aburch&c=1> On Fri, Aug 7, 2026 at 12:20 PM Scott Q. <[email protected]<mailto:[email protected]>> wrote: We got the same update and incidentally today we started getting even more reports of issues from Postmark... already sent the relevant details to Alex. Scott On Friday, 07-08-2026 at 09:51 Brian Peterson via mailop wrote: Was there any update on this? The latest I got from PostMark Support was this: (From Friday the 31st 16:56 CST) " Here is a breakdown of what your firewall logs are telling us and why everything changed around late May: 1. The May 22nd Changes & Rejected Connections You are spot on that something changed in late May! Earlier this year, Postmark migrated our underlying outbound mailing infrastructure to a new system called KumoMTA, which is an open-source MTA built for high-volume sending environments. This new system is highly concurrent and attempts to connect and deliver messages much faster than our previous setup. The fact that the <vendor redacted> email succeeded on May 1st makes perfect sense, as it was sent before this upgrade was fully rolled out to those IPs." We've increased TLS connection limits on our end, but still no resolution. -Brian From: Alex Burch <[email protected]<mailto:[email protected]>> Sent: Thursday, July 30, 2026 11:18 AM To: Brian Peterson <[email protected]<mailto:[email protected]>> Cc: Scott Q. <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]> Subject: Re: [mailop] Issues receiving from Postmark I am looking into this. I looks like we just have our TLS timeout set too strictly and we'll be expanding it today. Feel free to message me directly with any further issues or concerns regarding Postmark. Thanks, Alex -- Alexander Burch ActiveCampaign / Senior Deliverability Engineer mailto:[email protected]<mailto:[email protected]> 1 North Dearborn St Suite 500, Chicago IL, 60602 On Wed, Jul 29, 2026 at 12:57 PM Brian Peterson via mailop <mailto:[email protected]<mailto:[email protected]>> wrote: We’re seeing PostMark issues as well (Started maybe June or May?). Two separate members of ours, using two separate app vendors, both of which seem to use Postmark. The only info I have third hand is “Timed Out waiting 5s for response to cmd=STARTTLS”. I can’t seem to find any indication of rejected connections from Postmark on my end. Firewall logging also shows all traffic flows allowed for the items that DO make it through. Did you ever make any progress on your issue? Might these be related? (May 22-24th also sticks out as to some sort of change made, but I’m not sure if that was the app vendor or PostMark themselves.) From: Scott Q. <mailto:[email protected]<mailto:[email protected]>> Sent: Wednesday, July 15, 2026 1:30 PM To: mailto:[email protected]<mailto:[email protected]> Subject: [mailop] Issues receiving from Postmark If someone from Postmark is on the list..it seems we are having an issue receiving e-mails from you. Only error customers report is: smtp;400 KumoMTA internal: failed to connect to any candidate hosts: connect to http://65.39.216.37:25 and read initial banner: reading banner: Error Connection closed by peer reading response to cmd=NONE Sample e-mail: X-KumoRef: eyJfQF8iOiJcXF8vIiwicmVjaXBpZW50IjoiY2hyaXNAaW5zdXJldGhlYm9hdC5jb20ifQ== You can message me off-list - thank you! Scott _______________________________________________ mailop mailing list mailto:[email protected]<mailto:[email protected]> https://list.mailop.org/listinfo/mailop _______________________________________________ mailop mailing list [email protected]<mailto:[email protected]> https://list.mailop.org/listinfo/mailop
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
