capuderg
commented
1 year ago Hi @jahlives,
we didn't test such hostnames (that resolve to multiple IPs). But how would such a hostname be expected to connect to a correct IP, if it resolves to multiple IPs? That's not something our plugin is responsible for. We are using the WP bundled PHPMailer to connect to the SMTP server, so the hostname -> IP resolving is not something our plugin is doing, it relies on PHPMailer instead.
Having a reliable and safe connection is very important and adding an option to ignore that would cause a lot of user to be exposed to different security attacks, because they would just enable that option and forget about it.
There are WP filters that can disable the SSL certificate checks and I'm sure there are plugins that do that as well. So such plugins can be used for testing/debugging purposes.
Thank you for opening this report and have a nice day!
is it possible that the plugin runs into issues if a hostname for custom smtp server is provided which resolves to more than one ip? Had the case today that with such a hostname the plugin did not connect. I verified that according to the maillogs of the server. No connection try. But as soon as I changed the smtp server hostname to something that resolves to just one ip the connections can be seen in mailserver's logs.
Something more I found today: it would be great to have an option to allow mismatching TLS certificates (something like "ignore SSL CN / SMTP Hostname mismatch"). At least for testing it would be nice