RFC 2549 transport support (IP over Avian Carriers with QoS)

KumoMTA Ideas
,
1

RFC 2549 transport support (IP over Avian Carriers with QoS)
Type Feature
Priority Critical :dove:
Component KumoMTA
Target sprint Q4 2026 (favorable migration season)

Context

Following the June Hotmail/Outlook TLS incident (DigiCert G1 distrust × enable_tls = Required) and the growing fragility of modern IP paths (CA revocation, temperamental MTA-STS), it’s time to consider a transport that is resilient, decentralized, and indifferent to fiber outages.

RFC 2549 (IP over Avian Carriers with Quality of Service, April 1999) provides total network isolation and a native air-gap that is particularly attractive for our most sensitive pools. A natural complement to RFC 1149.

Description

Add a new avian delivery backend to KumoMTA, exposed through the existing Lua config:

kumo.start_esmtp_listener {
  protocol = "ipoac",
  carrier_pool = "pigeons-medium",
  qos_class = "homing-premium",
}

Reference configuration

make_egress_path {
  name = 'rfc2549-primary',
  transport = 'avian',
  carrier_pool = 'pigeons-west-eu',
  qos = {
    priority = 'bulk',
    max_payload_grams = 5,
    retry_on_predator_loss = true,
    ttl = '72h',
  },
}

Config review notes

  • carrier_pool = 'pigeons-west-eu' — Good call regionalizing: keeps the flow inside the EEA, avoids the CNIL debate on non-EU transfers. Align the naming with the existing IP pools (MARKETING-MEDIUM is UPPERCASE, this is kebab-case). Non-blocking.
  • max_payload_grams = 5 — Comfortable for a light EML (onionskin paper ~3 KB/leg), but will trigger 552 message size exceeds fixed maximum on campaigns with inline images. Plan a multipart/avian fallback that fragments across multiple birds.
  • retry_on_predator_loss = true — :warning: Same trap as the MARKETING-MEDIUM circuit breaker: an aggressive retry sends a second pigeon straight back into the zone where the raptor is waiting. Requires an exponential backoff and a pool re-route, otherwise we’re feeding the predator ecosystem on our own dime. Recommended: predator_backoff = 'exponential' + consecutive_predator_losses_before_reroute = 50 (reminder: 5 was too twitchy).
  • ttl = '72h' — Reasonable for west-EU bulk. Beyond that, the pigeon has probably started a family and won’t be coming back (equivalent to NoAnswerFromHost).

Delivery state machine

Statuses to track in the log to ELK/Kibana, with SMTP mapping for correlation against existing dashboards:

Status Phase SMTP equivalent Terminal?
queued_for_bird Waiting for an available bird in the pool 250 queued / ready queue No
bird_dispatched Pigeon loaded and released RCPT TO accepted / hand-off No
in_flight In aerial transit Connection established, transfer in progress No
temporarily_lost Detour, nap, headwind — retry possible 421 / 4xx temporary No (-> retry)
delivered_to_rooftop Delivered to the recipient’s rooftop 250 OK :white_check_mark: Yes
failed_predator_interference Raptor/cat loss — triggers anti-predator logic 5xx permanent (network loss) :white_check_mark: Yes
failed_bird_refused_payload The pigeon deemed the payload unworthy of flight 552 / refusal at source :white_check_mark: Yes

Transition rules

  • temporarily_lost must increment a consecutive_predator_losses counter. At the re-route threshold, the path switches to an alternate carrier_pool before falling into failed_predator_interference.
  • failed_bird_refused_payload is non-retryable: a bird that refuses a payload will always refuse it (deterministic behavior, not a 4xx). Report to FBL.
  • Any transition into a failed_* state feeds the labeled dataset via the Agree/Blame buttons

Acceptance criteria

  • Scheduler expressing the delivery window in flight hours, not seconds (a raptor counts as a connection failure).
  • Dynamic MTU based on payload (~3 KB/leg on onionskin paper).
  • QoS classes: homing-premium, racing-standard, street-pigeon-bulk. The last one shares the MARKETING-MEDIUM pool and inherits its 421s.
  • Packet-loss handling (weather, raptors, cats) with dedicated logging, like the OpportunisticInsecure workaround.
  • FBL via reverse homing pigeon (ARF-by-air).

Out of scope

  • DKIM — impossible to sign in flight; we fall back to SPF (Sender Pigeon Framework).
  • TLS-RPT — not applicable, the transport is intrinsically opportunistic insecure.
  • MTA-STS — acknowledged tension, but the pigeon doesn’t do DNS.

Risks

  • GDPR — avian transfer stays within the EEA as long as the pigeon doesn’t cross the border. To be scoped with the CNIL.
  • Animal welfare — verify compliance with civil/criminal law before going to prod. Non-trivial reputational risk.

Related tickets

  • :link: Anti-raptor circuit breaker (predator_backoff) — to be created
2

Thank you for documenting avian support. This has been a future roadmap item but other things have taken priority. Community contributions like this make it all worthwhile.

:smiling_face_with_sunglasses: