I am tagging collaboration-services for your information only, feel free to triage as you see fit :)

Seems like mx-in*.wikimedia.org do not like these emails for whatever reason:

2026-04-07 19:39:51 1wACH9-00BqE5-1C ** phabricator-no-reply@wmcloud.org R=dnslookup_unsigned T=remote_smtp_unsigned H=mx-in2001.wikimedia.org [208.80.153.75] I=[172.16.2.248] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=yes DN="CN=mx-in1001.wikimedia.org": SMTP error from remote mail server after RCPT TO:<phabricator-no-reply@wmcloud.org>: 550 5.1.1 <phabricator-no-reply@wmcloud.org>: Recipient address rejected: User unknown in relay recipient table DT=0s

In T422559#11796709, @taavi wrote:

Seems like mx-in*.wikimedia.org do not like these emails for whatever reason

my first guess/interpretation without digging too hard is the destination MX is sending a new SMTP connection back to the no-reply address (maybe because envelope-from or from) and the wmcloud.org MX is saying it doesn't exist so then the original connection is rejected too.

see https://dev.to/sofiatarhonska/how-to-verify-email-address-without-sending-an-email-10jp#email-box-pinging

Yeah, I guess it seems like this might potentially be being caused by Wikimedia's production mail infra somewhere.

FWIW, these are some sample headers from an email the test-instance might send (as extracted from an email it sent to me the other day). [If SREs would like to examine a fuller version of an email's headers, let me know.]

Date: Sun, 5 Apr 2026 07:24:23 +0000
To: Phabricator <phabricator-no-reply@wmcloud.org>
From: a_smart_kitten__test <phabricator-no-reply@wmcloud.org>
Cc: [my email address]
Reply-to: a_smart_kitten__test
 <T178+public+a082557452deb877@phabricator.wmcloud.org>
Subject: [Maniphest] [Commented On] T178: test task with other assignee set

[Having the To: header be the no-reply email address itself seems interesting; but IIUC this is the same as what production-Phabricator does, and it seems like it's (somewhat) documented in upstream's docs.]

From doing some searching, I found the patch 'postfix: verify recipients when possible' (for T325406) from July 2024, which seems like it might be what's causing Wikimedia's MX servers to reject these emails from the test Phab instance. cc @jhathaway FYI / in case you have any thoughts.

I guess one way of solving this might be to add wmcloud.org to profile::postfix::mx::unverifiable_domains (& maybe also wmflabs.org, for completeness). But I don't know enough about this configuration to currently know e.g. whether that'd be a good way of solving this.
(It might be worth noting that phabricator.wikimedia.org is already listed under that Hiera key.)