postfix logs showing ??? as command from client

Question

I am running an Ubuntu 18.04.6 LTS server with the postfix 3.1.0-3ubuntu0.4 package.

Both the Apple Mail client and the Postbox client experience a weird delay when first sending an email to the smtp service. Eventually Apple Mail retries and works but Postbox gives up.

In the initial exchange, the email client appears to send a '???' as a command after the server greeting, or at least it is logged that way by postfix. The line in the log looks like (actual ip address redacted):

Nov 23 17:11:09 mail postfix/smtpd[3367]: < ipxx-xxx-xxx-xxx.ph.ph.cox.net[xx.xxx.xxx.xxx]: ???

To which the server responds: 502 5.5.2 Error: command not recognized

What is going on here? I cannot find anywhere that the string '???' is considered a valid SMTP command. Is this some sort of hack for older systems?

While both of the above clients seem to send this, the iOS email client does not.

I have not found any documentation of this or tolerating this as a postfix setting.

Answer 1

Postfix replaces non-printable() characters with ? in its logs.

One way this could happen is a client instructed to establish a TLS connection yet using a port number where postfix is talking plaintext. The binary TLS1.3 ClientHello not being a valid SMTP command would show as ? in logs. The servers offer to upgrade an already existing unencrypted SMTP connection to a secure channel via the STARTTLS compatibility hack would usually go unnoticed. A clever MUA might recognize this mistake - and retry with settings deviating from configuration - where clever could easily venture in dangerous territory.

Assuming your postfix is setup to allow that; Configure your clients to use port 465/tcp ("Message Submission over TLS protocol") together with the instruction to use TLS right away. That is the recommended secure option for submitting mail. A few keywords that will help you identify the options that go together:

port	reserved for message submission via	what it is labelled in software settings
465	SMTP over TLS (recommended)	implicit TLS, TLS, SMTPS, clean TLS, wrappermode
587	SMTP plaintext with optional TLS	explicit TLS, STARTTLS, optional TLS, RFC 3207