Description

After upgrading Zabbix Server from 7.0.32 to 8.0.0, email notifications sent through Apple iCloud SMTP are rejected with:

550 5.7.1 [CS101] Message rejected due to local policy

The SMTP configuration was migrated unchanged. It had successfully delivered notifications for months under Zabbix 7.0.32, including a confirmed successful notification on the day of the migration.

After activating Zabbix 8.0.0, both automated event notifications and manual media-type tests began generating nondelivery reports.

Zabbix reports successful SMTP submission, but Apple subsequently rejects the messages.

Steps to reproduce

1. Configure Zabbix 8.0.0 with the Generic SMTP email media type using Apple iCloud SMTP (smtp.mail.me.com, port 587, STARTTLS, username/password authentication).

1. Configure an authenticated iCloud account with a custom-domain sender address.

1. Navigate to Alerts → Media types → Test.

1. Send a simple test email to an external recipient.

1. Observe that Zabbix reports "Media type test successful."

1. Observe that Apple subsequently generates a nondelivery report containing 550 5.7.1 [CS101].

The failure also occurs with automated event notifications.

Both HTML and plain-text message formats have been tested, with identical rejection behavior.

Actual result

Zabbix successfully authenticates and submits messages through Apple's SMTP infrastructure.

Apple subsequently rejects the outbound messages with:

550 5.7.1 [CS101] Message rejected due to local policy

The nondelivery report identifies the rejection in response to the end of the DATA command.

Zabbix records the notification as successfully sent, although the recipient does not receive it.

Expected result

Zabbix 8.0.0 should deliver notifications successfully through the existing SMTP configuration, as Zabbix 7.0.32 did immediately before the migration.

Investigation — Message-ID header regression

Comparison of the raw message source from the last successfully delivered Zabbix 7.0.32 notification against rejected Zabbix 8.0.0 messages reveals a potentially significant difference.

Zabbix 7.0.32 — successfully delivered

The successfully delivered notification contained:

• From: iCloud-hosted custom-domain sender

• To: External recipient

• Message-ID: Generated by Apple's mail infrastructure, using a fully qualified .me.com hostname

• In-Reply-To: Present, using a @zabbix.com identifier

• Content-Type: text/html; charset="UTF-8"

• Content-Transfer-Encoding: base64

The recipient's mail infrastructure confirmed:

{{spf=pass
dkim=pass
dmarc=pass
compauth=pass}}

The notification was successfully relayed through outbound.st.icloud.com and delivered to the recipient.

Zabbix 8.0.0 — rejected manual media-type test

The rejected test message contained a generated Message-ID ending in:

@zabbix

Apple subsequently generated a nondelivery report with 550 5.7.1 [CS101].

Zabbix 8.0.0 — rejected automated notification

The rejected event notification contained a generated Message-ID ending in:

@zabbix-events

It was rejected with the same Apple SMTP policy error.

Suspected cause

Zabbix 8.0 introduced Message-ID generation through ZBXNEXT-10244.

The newly generated identifiers use single-label domains (@zabbix and @zabbix-events) rather than fully qualified domains.

Under Zabbix 7.0.32, the successfully delivered message contained an iCloud-generated Message-ID using a fully qualified .me.com hostname.

This suggests that Apple's outbound mail-policy checks may be rejecting the identifiers generated by Zabbix 8.0.

This remains a hypothesis, not a confirmed root cause. Apple's CS101 error does not identify the specific header or policy responsible.

Importantly, the successfully delivered Zabbix 7.0.32 notification already contained an In-Reply-To header. Therefore, the presence of email-threading headers alone does not explain the rejection.

Additional validation

• The same SMTP account, sender identity, recipient, and media-type configuration worked under Zabbix 7.0.32.

• Successful delivery was confirmed on the day of migration, before Zabbix 8.0.0 was activated.

• Failures began following activation of Zabbix 8.0.0.

• SMTP connectivity and authentication succeed.

• Manual media-type tests report successful submission.

• Both automated notifications and simple manual test messages are rejected.

• HTML and plain-text message formats produce the same rejection.

• Notification volume was low, making excessive sending volume an unlikely explanation.

• The operating system and database were also upgraded, so the Zabbix version has not been independently isolated as the sole variable.

Request

Please investigate whether the Message-ID generation introduced in Zabbix 8.0 causes compatibility problems with SMTP providers enforcing outbound message-header policies, particularly Apple iCloud.

Specifically:

1. Could the use of @zabbix and @zabbix-events as Message-ID domains trigger the observed rejection?

1. Should Zabbix generate Message-ID values using a fully qualified domain?

1. Is there a supported configuration option or workaround to override the generated Message-ID domain?

1. Is a correction planned for an upcoming Zabbix 8.0 release?

Related issue

ZBXNEXT-10244 — Email notification is missing Message-ID header

https://support.zabbix.com/browse/ZBXNEXT-10244

Supporting evidence

Available upon request:

• Original message headers from a successfully delivered Zabbix 7.0.32 notification, including authentication results.

• Apple nondelivery report for a Zabbix 8.0 automated notification.

• Apple nondelivery report for a Zabbix 8.0 manual media-type test.

• Corresponding SMTP rejection diagnostics.

Any supporting evidence will be redacted before being shared publicly.