From e5caacd8375ad429ec568e877ee1c7bb968cab51 Mon Sep 17 00:00:00 2001
From: Mario Fetka <mario.fetka@gmail.com>
Date: Sun, 26 Jul 2026 19:25:28 +0200
Subject: [PATCH] Use SMTP port 25 for direct DANE lookups

---
 src/agents/smtp/smtpc.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/src/agents/smtp/smtpc.c b/src/agents/smtp/smtpc.c
index 12e0530..a35d892 100755
--- a/src/agents/smtp/smtpc.c
+++ b/src/agents/smtp/smtpc.c
@@ -1883,16 +1883,24 @@ ProcessEntry(void *clientp, Connection *conn)
             Remote.isLMTP = FindLMTPTransport(
                 &CurrentRecip, Remote.transportHost,
                 sizeof(Remote.transportHost), &Remote.transportPort);
-            Remote.conn = Remote.isLMTP
-                ? ConnectLMTP(&CurrentRecip, Remote.transportHost,
-                              Remote.transportPort)
-                : LookupRemoteMX(&CurrentRecip, Remote.transportHost,
-                                 sizeof(Remote.transportHost),
-                                 Remote.canonicalHost,
-                                 sizeof(Remote.canonicalHost),
-                                 Remote.originalNextHopDomain,
-                                 sizeof(Remote.originalNextHopDomain),
-                                 &Remote.mxDnssecAuthenticated);
+            if (Remote.isLMTP) {
+                Remote.conn = ConnectLMTP(
+                    &CurrentRecip, Remote.transportHost,
+                    Remote.transportPort);
+            } else {
+                /* Direct RFC 5321 MX delivery always uses SMTP port 25.
+                 * Preserve it in the transport metadata as well as the
+                 * socket address: DANE TLSA lookups are port-specific. */
+                Remote.transportPort = 25;
+                Remote.conn = LookupRemoteMX(
+                    &CurrentRecip, Remote.transportHost,
+                    sizeof(Remote.transportHost),
+                    Remote.canonicalHost,
+                    sizeof(Remote.canonicalHost),
+                    Remote.originalNextHopDomain,
+                    sizeof(Remote.originalNextHopDomain),
+                    &Remote.mxDnssecAuthenticated);
+            }
             if (!Remote.conn) {
                 /* There was an error looking up or connecting to the remote server. */
                 continue;