Microsoft PKI Services: Invalid Email Address for CPRs
The case concerns delivery of Certificate Problem Reports (CPRs) to Microsoft PKI Services. The CPS section cited by the CA states that c**********i@microsoft.com is the email address for CPRs, but emails sent to that address were rejected as undeliverable with a “sender not allowed” error. The rejection was attributed to c**********l@microsoft.com, which was described as a distribution list member that forwards to internal addresses and sometimes blocks external email without notifying Microsoft. Microsoft reported that CPRs were still being properly delivered to c**********i@microsoft.com, but that some forwarded recipients may not receive the mail due to the blocking behavior. Microsoft investigated whether c**********l@microsoft.com should remain cc’ed and made a change to the membership so that c**********l@microsoft.com was no longer nested within c**********i@microsoft.com, with replication expected to stop the rejection emails. The bug was then proposed to be closed as “Invalid” or “Fixed” because the email address accomplished its intended purpose of contacting Microsoft, and Microsoft indicated they removed the nested distribution list and would not add more distribution lists as members. The bug is marked RESOLVED with resolution FIXED.
- A CPR email sent to Microsoft’s c**********i@microsoft.com was rejected as undeliverable due to a delivery restriction on a nested distribution list member.
- Microsoft modified the centralpki distribution list membership to remove the nested c**********l@microsoft.com distribution list member.
- The reporter indicated the issue could be closed as invalid/fixed and Microsoft confirmed the nested distribution list was removed and no further DL members would be added.
- Mozilla representative — Reported that Microsoft PKI Services CPS points to c**********i@microsoft.com for CPRs, but emails to that address were rejected with a “sender not allowed” (550 5.7.133) error referencing c**********l@microsoft.com.
- Disabled representative — Stated that CPRs are properly delivered to c**********i@microsoft.com, and that c**********l@microsoft.com forwards to internal addresses that may block external email, causing rejection notifications.
- Disabled representative — Announced a membership change removing c**********l@microsoft.com from being nested within c**********i@microsoft.com, expecting rejection emails to stop after replication.
- Mozilla representative — Proposed closing the bug as “Invalid” or “Fixed” because the email address still contacted Microsoft, unless further input was received.
- Community commenter — Asked what actions Microsoft could take to prevent another distribution list member from blocking external email and confusing others.
- Disabled representative — Explained the blocking behavior was due to settings on a nested distribution list member and confirmed they removed that nested DL and are investigating possible design changes but are not committing yet.