Today, I spent half my day debugging an email error. I got a lot of bounces saying:
552 5.2.0 Message contains bare CR and is violating 822.bis section 2.3 (in reply to end of DATA command))In the 20+ years I'm running mailservers, I had never heard of this error before. And Google couldn't make me much wiser either.
The mailserver generating the message was mxin5.ziggo.nl - the primary server for Dutch provider Ziggo. I could not figure out which MTA they are using, although the banner right after an EHLO looks like Sendmail. I downloaded the latest Sendmail sources, but this error message does not come from a vanilla Sendmail installation. Other software like FortiMail may be a Sendmail fork or mimic the Sendmail signatures. But of course we cannot examine their source code.
I did find some references that qmail may have problems with bare LFs. But those were with regards to LF (line feed), not CR (carriage return). Downloaded the source of qmail and netqmail to find that qmail was probably not the MTA used either.
Then I tried to trace my own postfix server. Let's see that the mail does indeed contain a bare CR. I did not believe there was a bare CR as I examined the sourcecode of the generating software. Tracing is a lot harder nowadays since starttls will prevent a simple tcpdump. As an alternative, I used postfix' header_checks to HOLD a suspected mail and sure enough, the software generating the message included a stray CR = hex char %0D = \r in a small percentage of outgoing mails. The generating software used an external data source which inserted the CR.
The bug generating the CR in the emails is years old, the mails were always accepted by Ziggo without any problem. My best guess is that Ziggo recently upgraded their mailserver and the new version now forbids the CR.
© GeekLabInfo 552 5.2.0 Message contains bare CR and is violating 822.bis section 2.3 (in reply to end of DATA command)) is a post from GeekLab.info. You are free to copy materials from GeekLab.info, but you are required to link back to http://www.geeklab.info
(3 votes, average: 5.00 out of 5)
Loading...
Wow, thanks for this. It had me scratching my head all day today, though I didn't take nearly as deep a dive as you did to figure out the problem. Suddenly cron output going from my Ubuntu 22.04LTS with Postfix is being bounced by @shaw.ca with the 822.bis error. It turns out there is indeed a bare CR in the To: address I'm sending to, but the bounces only started today. So, I've got a little mitigation to do, and your analysis pointed me in the right direction.