[ipv6-wg] Experiences with IPv6-only MX as primary?

Am Mon, 11 Jun 2018 schrieb Shane Kerr:
> I set up a mail server zone to have an IPv6-only primary and a
> dual-protocol secondary, [...]
> Mail delivery via IPv6 works fine (as you would expect), and mail
> delivery from some IPv4-only servers also works fine (as I think the
> standards dictate).
> 
> My concern is that some mail servers may choke on this setup. For
> example, http://mailtester.com complains "Network is unreachable".

I have been running a similar setup for the last ~10 years and 
didn't see much problems with real smtp servers per se. But every now 
and then, services like mailtester in your case only check for 
the first MX and return a permanent error, _even_ if there is 
another dualstack MX configured. I have seen this a lot with newsletter
services or with live email-address-verification in various webinterfaces 
where they try a quick VRFY on the first MX AND do it legacy-only.

The same webservices and simple servers fail to verify email addresses 
from IPv6-only setups (for obvious reasons). I started to file Bugreports 
in these cases, because in my point of view, running an smtp without 
IPv6 should nowadays be considered to be a grave configuration bug.

Sometimes the reaction is quite fast. One german server hoster, for 
example, did IPv4 VRFY for the customer email address when they received 
DNS Zone Updates via Webinterface from a logged-in user. This failed 
badly if you had an IPv6-only email address. But they needed only 2 
work-days to fix their setup. Others are not so eager to help and ignore 
their trouble tickets for months or try to find excuses¹.

> Of course, I also worry about all the spammers who may not be able to
> deliver because of incomplete mail implementations on the trojans and
> other viruses infecting their zombie hosts. 😉

Current spam-rate (with ~10k mails per day running through a system 
_without_any_spamfilter_at_all is roughly 1 spam mail every two or 
three days. The domain for this test was conituously active since 
the mid 90's. So, real IPv6 spam is probably not (yet) the issue. 
But it is unclear, if greylisting, DNS black- and whitelists or 
other countermeasures will scale, when spammers really start to use 
IPv6. 

Unfortunately, "ip reputation" is something, people tend to 
misunderstand. Just a few weeks ago, a mail admin told me, that my 
"sending IPv6 IP has a bad reputation", because "google moved the
message to the spamfolder". Yeah. He alias-forwarded all mail from 
his personal mailserver and -domain to google. But my sending 
domain has an SPF record, so google decided to ditch it. Works like
expected. But I can already hear the drums: "Oh, NO. I won't 
do IPv6 on mailservers .... google tends to drop those mails ..." 
;-) 

Cheers,
Bjørn

¹) https://www.penguin.de/blog/bbu/2018/0411_the_good_the_bad_and_the_ugly_-_my_own_ipv6_survey