Chapter 03 Networking, DNS & Crypto Admin: #pNetwork

True Dual-Stack IPv6 ([::]) & Happy-Eyeballs Outbound MX

Starting in v1.2.4, all protocol listeners (ESMTP 25/465/587, IMAP 143/993, ManageSieve 4190) and Kestrel bind in native Dual-Stack mode ([::] with DualMode = true). A single kernel socket accepts both native IPv6 and IPv4 traffic while normalizing IPv4-mapped addresses (::ffff:x.x.x.x) cleanly across SPF, greylisting, and logs.

Operational Tip & Architecture Note

Golden rule of IPv6 mail: publish an AAAA record for mail.company.com ONLY after setting the matching IPv6 PTR record at your hosting provider and adding ip6:... to your SPF record! Gmail strictly rejects IPv6 senders lacking valid IPv6 PTR.

Verify Both IPv4 & IPv6 Reverse DNS (PTR) Before Publishing AAAA

Both lookups must return your exact ServerHostName (e.g. mail.company.com.).

Reference / Configuration

# Linux / macOS
dig +short -x 198.51.100.10
dig +short -x 2001:db8::10

# Windows PowerShell
Resolve-DnsName 198.51.100.10 -Type PTR
Resolve-DnsName 2001:db8::10 -Type PTR

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`BindAddress (Smtp / Imap / ManageSieve)`	Controls local socket binding. Wildcards (::, [::], 0.0.0.0, *) automatically enable Dual-Stack IPv6 + IPv4 with graceful IPv4 fallback if OS IPv6 is disabled.	`:: (Dual-Stack IPv6 + IPv4)`	Leave at default :: so both IPv6 and IPv4 peers connect seamlessly; bind a specific IP only on multi-homed hosts with separate MTAs.
`Ausgehendes Happy-Eyeballs MX`	Interleaves resolved MX AAAA and A targets and falls back immediately to IPv4 if an IPv6 route is unreachable or blocked.	`Automatisch aktiv / Auto`	When native IPv6 routing is active on the OS, ensure your IPv6 PTR matches ServerHostName and outbound IPv6 TCP 25 is permitted.
`IPv6 /64 Subnetz-Greylisting & Rate-Limit`	Groups ephemeral IPv6 addresses within the same /64 prefix together (matching /24 grouping on IPv4) for greylisting and abuse throttling.	`/64 Präfix (IPv6) · /24 (IPv4)`	Keep default /64 grouping so legitimate IPv6 MTAs rotating host addresses inside their /64 block pass greylisting cleanly on first retry.