How to allow postfix to parse recipient address with percent signs in them?

Question

I am having a mail delivered to a Postfix mail server.

• That mail got the following address: else%2bsomething@domain.com (It is basically a url encoded version of else+something@domain.com, which should be valid by RFC.)
• The sender's mail server is being told to go way with this message: NOQUEUE: reject: RCPT from randostring.outbound.protection.outlook.com[...]: 454 4.7.1 <else%2bsomething@domain.com>: Relay access denied; from=<john.doe@live.com> to=<else%2bsomething@domain.com> proto=ESMTP helo=<morerando.outbound.protection.outlook.com>
• The log tells me: generic_checks: name=defer_unauth_destination status=2, which I assume is the problem here.
• I have a MySQL lookup for the $virtual_alias_domains, which does not get queried during the time the log message above is created. I think it might be cached for some time, but I could be totally wrong here.

What I have tried:

• Disable/Enable allow_percent_hack to see if that is the reason, I get rejected. Nothing changes for either setting.
• Tried to change the recipient_delimiter to '%', which did not change anything.

My question: How can I force postfix to deliver this email? I really do not need a permanent solutions, as I consider this to be an edge case.

Bonus points, if you can explain to me, why this email is not received in the first place, because I really want to know why this is happening. :)

---

Edit #1:

I found a difference in the flags for a working and a non-working message.

• Delivered message: Flag: 1024
• Not Delivered message: Flag: 1026

By looking at different places in the source code (Flag definition: https://github.com/vdukhovni/postfix/blob/bfff4380a3b6fac2513c73531ee3a79212c08660/postfix/src/global/resolve_clnt.h#L36-L37 and Flag usage: https://github.com/vdukhovni/postfix/blob/ed3f86da7c3e15cf1ec57241c1f6036d82b790da/postfix/src/trivial-rewrite/resolve.c#L467-L468), I found out, that as soon as there is another @, !, or % in the email address, it sets a routed flag, which is then handled later on.

What I have not found out yet is, how can I

a) prevent that from happening

or

b) Hack a little something together to actually route him "back" to my server.

Answer 1

The combination of these two settings does the trick:

allow_percent_hack = no
allow_untrusted_routing = yes

But be careful! The Postfix documentation warns about the potential for "a nasty open relay loophole" when overriding the default setting of allow_untrusted_routing.

Without these settings, Postfix rejects this kind of destination address because the default setting allow_percent_hack = yes tells Postfix to support the obsolete source routing mechanism known as "the so-called %-hack", as described in Section 7 of RFC 1711, while the default setting allow_untrusted_routing = no tells Postfix to reject source routing from untrusted clients.

In other words, Postfix rejects this kind of destination by default because it thinks else%2bsomething@domain.com means "deliver to else@2bsomething by way of domain.com", but only trusted clients are allowed to do that, due to spammers.