IETF email infrastructure overhaul set for 11 September

The Internet Engineering Task Force (IETF) has scheduled a major upgrade to its email infrastructure, replacing a legacy system that has grown increasingly complex over the years. The transition is set to begin at 22:00 UTC on 11 September 2026, with expected delays of up to 60 minutes for message delivery during the cutover. While the web interface for Mailman3 mailing lists will be temporarily unavailable, access to archives and IMAP services will remain unaffected throughout the process.

The new infrastructure introduces a containerized architecture, where each functional component—such as spam filtering, address rewriting, and certificate management—operates in isolated Kubernetes-managed containers. This modular design allows for horizontal scaling of individual services as demand fluctuates. The sole exception is outbound mail relaying, which will continue to run on dedicated virtual machines hosted in trusted networks to maintain deliverability and reputation.

Core technical changes

At the heart of the upgrade is a refactored version of postconfirm, an open-source milter that acts as a gatekeeper for incoming mail. The tool now uses rspamd for spam detection, replacing the older SpamAssassin stack. Postconfirm’s primary role is to verify first-time senders via an email-based challenge-response mechanism, ensuring compliance with the IETF’s Note Well policies before allowing messages to proceed. Once a sender completes the challenge, their address is added to an allow list, and any previously held messages are released for delivery.

Address rewriting has also been overhauled to improve DMARC and SPF alignment. For outbound mail, the system checks the sender’s domain policies: if the envelope From domain lacks SPF alignment with IETF’s IP addresses, or if the domain enforces a p=reject or p=quarantine DMARC policy, the address is rewritten in a standardized format (e.g., user=40example.com@dmarc.ietf.org). The message is then DKIM-signed with the appropriate domain key, ensuring DMARC compliance. Inbound mail undergoes a similar process, with the system validating rewritten addresses against a database to prevent open relay abuse.

Certificate management has been streamlined to support DANE (DNS-based Authentication of Named Entities). The new system employs a current + next rollover scheme, ensuring uninterrupted TLS availability even during certificate renewals. Rspamd handles DKIM signing and spam assessments, with provisions for post-deployment tuning to adapt to evolving threats.

Operational impact and long-term goals

The transition is part of a broader, multi-year effort to modernize the IETF’s IT infrastructure. The current email system, which has evolved organically over decades, has become difficult to maintain and upgrade. By adopting a containerized, modular approach, the IETF aims to reduce operational overhead while improving resilience and scalability. The new stack is also designed to integrate more seamlessly with the IETF Datatracker, enabling unified management of mailing list subscriptions and user accounts.

All software components developed for the transition are open-source and available in the IETF Tools GitHub repository. Feedback and issue reports can be submitted via the tools-discuss@ietf.org mailing list. The contractor New Machine Futures has been instrumental in implementing the infrastructure changes under the oversight of the IETF Administration LLC.

What to watch

The immediate focus is ensuring a smooth cutover on 11 September, with minimal disruption to mailing list participants. Longer-term, the IETF plans to leverage the new infrastructure to introduce additional features, such as enhanced bounce handling and further refinements to spam filtering. The modular design also paves the way for future upgrades, including potential integrations with emerging email security standards or AI-driven threat detection tools.