nodemailer 10.0.15 → 10.1.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # CHANGELOG
 
+## [10.1.0](https://github.com/nodemailer/nodemailer/compare/v10.0.16...v10.1.0) (2026-10-10)
+
+
+### Features
+
+* harden message streams, SMTP connections and the connection pool ([8009da6](https://github.com/nodemailer/nodemailer/commit/8009da6e10bb8e10d7f0948a25d65895fdcd64f1))
+
+
+### Bug Fixes
+
+* do not read the environment or the interface table on import ([094179d](https://github.com/nodemailer/nodemailer/commit/094179d176d2ebe7a28742411ad427d3c87a3981))
+* end the SMTP session on any 421 reply and drive the envelope through one step ([5638ac1](https://github.com/nodemailer/nodemailer/commit/5638ac1914342460df270f736e7ceb0a844cf83a))
+* keep ERR_ACCESS_DENIED from the Node.js permission model ([8b33a3d](https://github.com/nodemailer/nodemailer/commit/8b33a3d4fedee3431b97da7da12af954c3c8dceb))
+* let the proxy handshake and the SMTP connection share one deadline ([91ed683](https://github.com/nodemailer/nodemailer/commit/91ed683f7a1e9ff8c56e24fb76facf16af08b162))
+* **mime-node:** decode an SMTPUTF8 domain from its A-label form ([e436f4d](https://github.com/nodemailer/nodemailer/commit/e436f4dccbc8b0fb57b4747ebaafa5bb035c15cb))
+* **mime-node:** finish an encoded part only after its output was read ([ec97d8f](https://github.com/nodemailer/nodemailer/commit/ec97d8f679a1d9d47bbebb03ea064f5fa6f58d01))
+* **qp:** encode a lone CR or LF in binary quoted-printable parts ([42b91d9](https://github.com/nodemailer/nodemailer/commit/42b91d9a0fe18eea412c9774c5c142adf5b3efc7))
+* **smtp-connection:** count the wait for the greeting against connectionTimeout ([bdcd046](https://github.com/nodemailer/nodemailer/commit/bdcd0462cab163eca3c34058d09b9981ab671c47))
+* **smtp-connection:** drop the connection when DATA is taken after a refused sender ([f90fb04](https://github.com/nodemailer/nodemailer/commit/f90fb045bc24f96a128710791b2fa443e64f55fd))
+* **smtp-connection:** refuse a second connect() call ([24ba2e0](https://github.com/nodemailer/nodemailer/commit/24ba2e0847ecb8202540f1c5e53483bd119ae4f2))
+* turn Nagle off for SMTP sockets and report an early sendmail exit as such ([fa9b8d3](https://github.com/nodemailer/nodemailer/commit/fa9b8d300bf642cd9e11f6732ebb312c09868677))
+
+
+### Performance Improvements
+
+* encode base64 and quoted-printable without per-chunk delays ([fd377bb](https://github.com/nodemailer/nodemailer/commit/fd377bbf559363860aedbedba6f107348fc152d2))
+
+## [10.0.16](https://github.com/nodemailer/nodemailer/compare/v10.0.15...v10.0.16) (2026-10-07)
+
+
+### Bug Fixes
+
+* **addressparser:** keep an escaped parenthesis inside a comment ([c4ae20d](https://github.com/nodemailer/nodemailer/commit/c4ae20d074ac0510cc2d0cbd6039ee7fab3a4ca8))
+* **fetch:** keep the case of cookie names ([#1888](https://github.com/nodemailer/nodemailer/issues/1888)) ([9f16eed](https://github.com/nodemailer/nodemailer/commit/9f16eedf8de0485e6d07969113db992ff70f89ce))
+* **fetch:** read the cookie name-value pair by position ([645e97c](https://github.com/nodemailer/nodemailer/commit/645e97c8f0586404d9fb861c9527be7572c2c832))
+
 ## [10.0.15](https://github.com/nodemailer/nodemailer/compare/v10.0.14...v10.0.15) (2026-10-05)
 
 

package/dist/cjs/addressparser/index.js

@@ -670,7 +670,11 @@ class Tokenizer {
             this.escaped = false;
             return;
         }
-        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+        else if (['"', "'", ')'].includes(this.operatorExpecting) && chr === '\\') {
+            // A backslash escapes the next character inside a quoted string and inside a
+            // comment alike (RFC 5322 3.2.2, ccontent includes quoted-pair). Honouring it
+            // only in quoted strings let an escaped parenthesis close the comment, which
+            // released the rest of it, an address included, into the header
             this.escaped = true;
             return;
         }

package/dist/cjs/base64/index.d.ts

@@ -24,6 +24,9 @@ export interface EncoderOptions {
 /**
  * Creates a transform stream for encoding data to base64 encoding
  *
+ * The output is the same as `wrap(encode(input), lineLength)` no matter how the input is split
+ * into chunks: every line but the last one ends with a line break, the last one does not
+ *
  * @constructor
  * @param options Stream options
  * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping

package/dist/cjs/base64/index.js

@@ -16,6 +16,47 @@ function encode(buffer) {
     }
     return buffer.toString('base64');
 }
+/**
+ * Turns a line length option into a whole number of characters, the default for anything unusable
+ */
+function normalizeLineLength(lineLength) {
+    const length = Math.floor(Number(lineLength));
+    return Number.isFinite(length) && length >= 1 ? length : 76;
+}
+/**
+ * Splits the bytes of `src` into lines of `lineLength` bytes, each followed by a line break. With
+ * `final` set the last line, which may be shorter, gets no line break; otherwise only complete
+ * lines are taken and the rest is left for the caller
+ *
+ * @param src Bytes to wrap
+ * @param lineLength Line length
+ * @param final Whether `src` ends the output
+ * @returns The wrapped bytes and the number of trailing bytes not taken
+ */
+function wrapBuffer(src, lineLength, final) {
+    const lines = Math.ceil(src.length / lineLength);
+    // the last line waits for more data unless this is the end: whether it gets a line break
+    // depends on whether anything follows it
+    const complete = Math.max(lines - 1, 0);
+    let rest = src.length - complete * lineLength;
+    const output = Buffer.allocUnsafe(complete * (lineLength + 2) + (final ? rest : 0));
+    let to = 0;
+    for (let from = 0; from < complete * lineLength; from += lineLength) {
+        src.copy(output, to, from, from + lineLength);
+        to += lineLength;
+        output[to++] = 0x0d;
+        output[to++] = 0x0a;
+    }
+    if (final) {
+        to += src.copy(output, to, complete * lineLength);
+        rest = 0;
+    }
+    if (to !== output.length) {
+        // never hand out bytes of the unfilled allocation
+        throw new Error('Unexpected wrapped length');
+    }
+    return { output, rest };
+}
 /**
  * Adds soft line breaks to a base64 string
  *
@@ -44,6 +85,9 @@ function wrap(str, lineLength) {
 /**
  * Creates a transform stream for encoding data to base64 encoding
  *
+ * The output is the same as `wrap(encode(input), lineLength)` no matter how the input is split
+ * into chunks: every line but the last one ends with a line break, the last one does not
+ *
  * @constructor
  * @param options Stream options
  * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping
@@ -53,66 +97,61 @@ class Encoder extends node_stream_1.Transform {
         super();
         this.options = options || {};
         if (this.options.lineLength !== false) {
-            this.options.lineLength = this.options.lineLength || 76;
+            this.options.lineLength = normalizeLineLength(this.options.lineLength);
         }
         this._curLine = '';
         this._remainingBytes = false;
         this.inputBytes = 0;
         this.outputBytes = 0;
     }
+    /**
+     * Emits the encoded characters `b64` that follow the current line, keeping what can not be
+     * emitted yet as the new current line
+     *
+     * @internal
+     */
+    _emit(b64, final) {
+        const src = Buffer.from(this._curLine + b64, 'latin1');
+        if (!src.length) {
+            return;
+        }
+        let output = src;
+        if (this.options.lineLength) {
+            const wrapped = wrapBuffer(src, this.options.lineLength, final);
+            output = wrapped.output;
+            this._curLine = wrapped.rest ? src.toString('latin1', src.length - wrapped.rest) : '';
+        }
+        else {
+            this._curLine = '';
+        }
+        if (output.length) {
+            this.outputBytes += output.length;
+            this.push(output);
+        }
+    }
     /** @internal */
     _transform(chunk, encoding, done) {
         let buf = encoding !== 'buffer' ? Buffer.from(chunk, encoding) : chunk;
         if (!buf || !buf.length) {
-            setImmediate(done);
-            return;
+            return done();
         }
         this.inputBytes += buf.length;
-        if (this._remainingBytes && this._remainingBytes.length) {
+        if (this._remainingBytes) {
             buf = Buffer.concat([this._remainingBytes, buf], this._remainingBytes.length + buf.length);
             this._remainingBytes = false;
         }
-        if (buf.length % 3) {
-            this._remainingBytes = buf.slice(buf.length - (buf.length % 3));
-            buf = buf.slice(0, buf.length - (buf.length % 3));
-        }
-        else {
-            this._remainingBytes = false;
-        }
-        let b64 = this._curLine + encode(buf);
-        if (this.options.lineLength) {
-            b64 = wrap(b64, this.options.lineLength);
-            // remove last line as it is still most probably incomplete
-            const lastLF = b64.lastIndexOf('\n');
-            if (lastLF < 0) {
-                this._curLine = b64;
-                b64 = '';
-            }
-            else if (lastLF === b64.length - 1) {
-                this._curLine = '';
-            }
-            else {
-                this._curLine = b64.substring(lastLF + 1);
-                b64 = b64.substring(0, lastLF + 1);
-            }
-        }
-        if (b64) {
-            this.outputBytes += b64.length;
-            this.push(Buffer.from(b64, 'ascii'));
+        const extra = buf.length % 3;
+        if (extra) {
+            this._remainingBytes = buf.subarray(buf.length - extra);
+            buf = buf.subarray(0, buf.length - extra);
         }
-        setImmediate(done);
+        this._emit(encode(buf), false);
+        done();
     }
     /** @internal */
     _flush(done) {
-        if (this._remainingBytes && this._remainingBytes.length) {
-            this._curLine += encode(this._remainingBytes);
-        }
-        if (this._curLine) {
-            this._curLine = wrap(this._curLine, this.options.lineLength);
-            this.outputBytes += this._curLine.length;
-            this.push(Buffer.from(this._curLine, 'ascii'));
-            this._curLine = '';
-        }
+        this._emit(this._remainingBytes ? encode(this._remainingBytes) : '', true);
+        this._remainingBytes = false;
         done();
     }
 }

package/dist/cjs/dkim/index.js

@@ -37,51 +37,67 @@ class DKIMSigner {
         this.output = output;
         this.output.usingCache = false;
         this.hasErrored = false;
-        this.input.on('error', err => {
+        this.input.on('error', err => this.fail(err));
+        // A consumer that goes away before the signed message was read in full destroys the
+        // output. Stop reading the input and drop the cache file instead of leaving them open
+        this.output.once('close', () => {
+            if (this.output.writableFinished) {
+                return;
+            }
             this.hasErrored = true;
+            this.input.unpipe();
+            this.input.destroy();
             this.cleanup();
-            output.emit('error', err);
         });
     }
+    /**
+     * Ends the output with an error and releases the cache file
+     */
+    fail(err) {
+        this.hasErrored = true;
+        this.cleanup();
+        this.output.destroy(err);
+    }
     cleanup() {
         if (!this.cache || !this.cachePath) {
             return;
         }
+        const cache = this.cache;
+        this.cache = false;
+        cache.destroy();
         node_fs_1.default.unlink(this.cachePath, () => false);
     }
     createReadCache() {
         // pipe remainings to cache file
         this.cache = node_fs_1.default.createReadStream(this.cachePath);
-        this.cache.once('error', err => {
-            this.cleanup();
-            this.output.emit('error', err);
-        });
+        this.cache.once('error', err => this.fail(err));
         this.cache.once('close', () => {
             this.cleanup();
         });
         this.cache.pipe(this.output);
     }
     sendNextChunk() {
-        if (this.hasErrored) {
-            return;
-        }
-        if (this.readPos >= this.chunks.length) {
-            if (!this.cache) {
-                this.output.end();
+        while (!this.hasErrored) {
+            if (this.readPos >= this.chunks.length) {
+                if (!this.cache) {
+                    this.output.end();
+                    return;
+                }
+                return this.createReadCache();
+            }
+            const chunk = this.chunks[this.readPos++];
+            if (this.output.write(chunk) === false) {
+                this.output.once('drain', () => {
+                    this.sendNextChunk();
+                });
                 return;
             }
-            return this.createReadCache();
-        }
-        const chunk = this.chunks[this.readPos++];
-        if (this.output.write(chunk) === false) {
-            this.output.once('drain', () => {
-                this.sendNextChunk();
-            });
-            return;
         }
-        setImmediate(() => this.sendNextChunk());
     }
     sendSignedOutput() {
+        if (this.hasErrored) {
+            return;
+        }
         let keyPos = 0;
         const signNextKey = () => {
             if (keyPos >= this.keys.length) {
@@ -101,9 +117,7 @@ class DKIMSigner {
                 });
             }
             catch (err) {
-                this.hasErrored = true;
-                this.cleanup();
-                this.output.emit('error', err);
+                this.fail(err);
                 return;
             }
             if (dkimField) {
@@ -122,7 +136,6 @@ class DKIMSigner {
         // pipe remainings to cache file
         this.cache = node_fs_1.default.createWriteStream(this.cachePath);
         this.cache.once('error', err => {
-            this.cleanup();
             // drain input
             this.relaxedBody.unpipe(this.cache);
             this.relaxedBody.on('readable', () => {
@@ -130,11 +143,12 @@ class DKIMSigner {
                     // do nothing
                 }
             });
-            this.hasErrored = true;
-            // emit error
-            this.output.emit('error', err);
+            this.fail(err);
         });
         this.cache.once('close', () => {
+            if (this.hasErrored) {
+                return;
+            }
             this.sendSignedOutput();
         });
         this.relaxedBody.removeAllListeners('readable');
@@ -211,7 +225,7 @@ class DKIM {
             catch (_E) {
                 // the body hash is created here, an unknown hashAlgo throws inside this timer
                 // where nothing else could catch it
-                output.emit('error', sign_js_1.default.unsupportedHashAlgoError(signer.hashAlgo));
+                signer.fail(sign_js_1.default.unsupportedHashAlgoError(signer.hashAlgo));
                 return;
             }
             if (writeValue) {

package/dist/cjs/dkim/message-parser.js

@@ -107,7 +107,7 @@ class MessageParser extends node_stream_1.Transform {
                 const chunk = data.slice(headerPos);
                 this.bodySize += chunk.length;
                 // this would be the first chunk of data sent downstream
-                setImmediate(() => this.push(chunk));
+                this.push(chunk);
             }
             return false;
         }
@@ -136,7 +136,7 @@ class MessageParser extends node_stream_1.Transform {
             this.bodySize += chunk.length;
             this.push(chunk);
         }
-        setImmediate(callback);
+        callback();
     }
     /** @internal */
     _flush(callback) {

package/dist/cjs/errors.d.ts

@@ -61,6 +61,19 @@ export declare const EPROXY = "EPROXY";
 export declare const EFILEACCESS = "EFILEACCESS";
 export declare const EURLACCESS = "EURLACCESS";
 export declare const EFETCH = "EFETCH";
+/**
+ * Tells whether the error ended the connection rather than rejected what was sent over it
+ */
+export declare const isTransientError: (err: {
+    code?: string | undefined;
+    responseCode?: number | undefined;
+}) => boolean;
+/**
+ * Code Node.js sets on an error when its permission model (`--permission`) denies an
+ * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
+ * `EDNS`, `EFETCH`, ...), so a missing grant such as `--allow-net` stays recognizable.
+ */
+export declare const ERR_ACCESS_DENIED = "ERR_ACCESS_DENIED";
 /**
  * An Error together with the properties Nodemailer attaches to the errors it
  * hands to callers. Every property is optional, the set that is present
@@ -84,6 +97,10 @@ export interface NodemailerError extends NodeJS.ErrnoException {
     rejected?: string[] | undefined;
     /** Per-recipient errors for the rejected addresses */
     rejectedErrors?: NodemailerError[] | undefined;
+    /** The code the error had before Nodemailer set its own, such as ECONNREFUSED for an ESOCKET error */
+    originalCode?: string | undefined;
+    /** Which wait an ETIMEDOUT error ended: connecting, the greeting, a TLS upgrade or an idle socket */
+    timeoutType?: 'CONNECT_TIMEOUT' | 'GREETING_TIMEOUT' | 'UPGRADE_TIMEOUT' | 'SOCKET_TIMEOUT' | undefined;
 }
 /**
  * Node style callback: called with an error, or with null and the result

package/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -68,3 +68,14 @@ exports.EPROXY = 'EPROXY';
 exports.EFILEACCESS = 'EFILEACCESS';
 exports.EURLACCESS = 'EURLACCESS';
 exports.EFETCH = 'EFETCH';
+/**
+ * Tells whether the error ended the connection rather than rejected what was sent over it
+ */
+const isTransientError = (err) => err.responseCode === 421 || err.code === exports.ECONNECTION || err.code === exports.ESOCKET || err.code === exports.ETIMEDOUT;
+exports.isTransientError = isTransientError;
+/**
+ * Code Node.js sets on an error when its permission model (`--permission`) denies an
+ * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
+ * `EDNS`, `EFETCH`, ...), so a missing grant such as `--allow-net` stays recognizable.
+ */
+exports.ERR_ACCESS_DENIED = 'ERR_ACCESS_DENIED';

package/dist/cjs/fetch/cookies.js

@@ -130,19 +130,31 @@ class Cookies {
      */
     parse(cookieStr) {
         const cookie = {};
+        let hasNameValue = false;
         (cookieStr || '')
             .toString()
             .split(';')
             .forEach(cookiePart => {
+            if (!cookiePart.trim()) {
+                // skip empty parts
+                return;
+            }
             const valueParts = cookiePart.split('=');
-            const key = valueParts.shift().trim().toLowerCase();
+            const name = valueParts.shift().trim();
             let value = valueParts.join('=').trim();
             let domain;
-            if (!key) {
-                // skip empty parts
+            // the first part is always the name-value pair, so a cookie named
+            // like an attribute is not mistaken for one (RFC 6265 section 5.2)
+            if (!hasNameValue) {
+                hasNameValue = true;
+                if (name) {
+                    // cookie names are case-sensitive, only attribute names are not
+                    cookie.name = name;
+                    cookie.value = value;
+                }
                 return;
             }
-            switch (key) {
+            switch (name.toLowerCase()) {
                 case 'expires': {
                     const expires = new Date(value);
                     // ignore date if can not parse it
@@ -170,11 +182,6 @@ class Cookies {
                 case 'httponly':
                     cookie.httponly = true;
                     break;
-                default:
-                    if (!cookie.name) {
-                        cookie.name = key;
-                        cookie.value = value;
-                    }
             }
         });
         return cookie;

package/dist/cjs/fetch/index.js

@@ -81,6 +81,17 @@ const TLS_OPTION_KEYS = [
     'sessionIdContext',
     'sigalgs'
 ];
+/**
+ * Marks an error of the request as a fetch error, unless it is a permission model
+ * denial, which keeps its own code (see ERR_ACCESS_DENIED)
+ *
+ * @param err Error to mark
+ */
+function setFetchCode(err) {
+    if (err.code !== errors.ERR_ACCESS_DENIED) {
+        err.code = errors.EFETCH;
+    }
+}
 /**
  * Resolves a URL only if it is one this module is willing to request.
  *
@@ -177,7 +188,7 @@ function nmfetch(url, options) {
                     return;
                 }
                 finished = true;
-                err.code = errors.EFETCH;
+                setFetchCode(err);
                 err.sourceUrl = url;
                 fetchRes.emit('error', err);
             });
@@ -250,7 +261,7 @@ function nmfetch(url, options) {
     catch (E) {
         finished = true;
         setImmediate(() => {
-            E.code = errors.EFETCH;
+            setFetchCode(E);
             E.sourceUrl = url;
             fetchRes.emit('error', E);
         });
@@ -262,7 +273,7 @@ function nmfetch(url, options) {
             return;
         }
         finished = true;
-        err.code = errors.EFETCH;
+        setFetchCode(err);
         err.sourceUrl = sourceUrl;
         fetchRes.emit('error', err);
         req.abort();
@@ -272,6 +283,15 @@ function nmfetch(url, options) {
         req.setTimeout(timeout, () => fail(new Error('Request Timeout')));
     }
     req.on('error', (err) => fail(err));
+    // a consumer that destroys the response stream before it ended does not want the rest of
+    // the body, release the request now instead of when the timeout fires
+    fetchRes.once('close', () => {
+        if (finished || fetchRes.readableEnded) {
+            return;
+        }
+        finished = true;
+        req.destroy();
+    });
     req.on('response', res => {
         let inflate;
         if (finished) {

package/dist/cjs/mailer/index.js

@@ -157,6 +157,11 @@ class Mail extends node_events_1.EventEmitter {
             this.getSocket = false;
         }
         const mail = new mail_message_js_1.default(this, data);
+        // a failed message is not going to be read anymore, release its content streams
+        const fail = (err) => {
+            mail.releaseStreams();
+            done(err);
+        };
         this.logger.debug({
             tnx: 'transport',
             name: this.transporter.name,
@@ -170,7 +175,7 @@ class Mail extends node_events_1.EventEmitter {
                     tnx: 'plugin',
                     action: 'compile'
                 }, 'PluginCompile Error: %s', err.message);
-                return done(err);
+                return fail(err);
             }
             let recipientCount;
             try {
@@ -187,7 +192,7 @@ class Mail extends node_events_1.EventEmitter {
                     tnx: 'transport',
                     action: 'send'
                 }, 'Compile Error: %s', err.message);
-                return done(err);
+                return fail(err);
             }
             const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
             if (maxRecipients && recipientCount > maxRecipients) {
@@ -198,7 +203,7 @@ class Mail extends node_events_1.EventEmitter {
                     tnx: 'transport',
                     action: 'send'
                 }, 'Send Error: %s', err.message);
-                return done(err);
+                return fail(err);
             }
             this._processPlugins('stream', mail, err => {
                 if (err) {
@@ -207,7 +212,7 @@ class Mail extends node_events_1.EventEmitter {
                         tnx: 'plugin',
                         action: 'stream'
                     }, 'PluginStream Error: %s', err.message);
-                    return done(err);
+                    return fail(err);
                 }
                 if (mail.data.dkim || this.dkim) {
                     mail.message.processFunc(input => {
@@ -222,6 +227,7 @@ class Mail extends node_events_1.EventEmitter {
                 }
                 this.transporter.send(mail, (...args) => {
                     if (args[0]) {
+                        mail.releaseStreams();
                         this.logger.error({
                             err: args[0],
                             tnx: 'transport',
@@ -289,6 +295,11 @@ class Mail extends node_events_1.EventEmitter {
         // setup socket handler for the mailer object
         this.getSocket = (options, callback) => {
             const protocol = proxy.protocol.replace(/:$/, '').toLowerCase();
+            // The proxy handshake is a part of connecting and draws from the same deadline as the
+            // SMTP connection that follows it: whatever the proxy takes, the connection does not get
+            const configuredTimeout = Number(this.options.connectionTimeout) || 0;
+            const connectStartedAt = Number(options.connectStartedAt) || Date.now();
+            const connectionTimeout = configuredTimeout ? Math.max(connectStartedAt + configuredTimeout - Date.now(), 1) : undefined;
             if (this.meta.has('proxy_handler_' + protocol)) {
                 return this.meta.get('proxy_handler_' + protocol)(proxy, options, callback);
             }
@@ -296,7 +307,7 @@ class Mail extends node_events_1.EventEmitter {
                 // Connect using a HTTP CONNECT method
                 case 'http':
                 case 'https':
-                    (0, http_proxy_client_js_1.default)(proxy.href, options.port, options.host, this.options.tls || {}, (err, socket) => {
+                    (0, http_proxy_client_js_1.default)(proxy.href, options.port, options.host, connectionTimeout ? Object.assign({}, this.options.tls, { timeout: connectionTimeout }) : this.options.tls || {}, (err, socket) => {
                         if (err) {
                             return callback(err);
                         }
@@ -330,6 +341,9 @@ class Mail extends node_events_1.EventEmitter {
                             },
                             command: 'connect'
                         };
+                        if (connectionTimeout) {
+                            connectionOpts.timeout = connectionTimeout;
+                        }
                         if (proxy.username || proxy.password) {
                             const username = proxy.username || '';
                             const password = proxy.password || '';
@@ -359,11 +373,13 @@ class Mail extends node_events_1.EventEmitter {
                     if (node_net_1.default.isIP(proxy.hostname)) {
                         return connect(proxy.hostname);
                     }
-                    return node_dns_1.default.resolve(proxy.hostname, (err, address) => {
+                    // lookup goes through the hosts file and returns an IPv6 address as well,
+                    // the same way a connection to the proxy host would be resolved otherwise
+                    return node_dns_1.default.lookup(proxy.hostname, (err, address) => {
                         if (err) {
                             return callback(err);
                         }
-                        connect(Array.isArray(address) ? address[0] : address);
+                        connect(address);
                     });
                 }
             }

package/dist/cjs/mailer/mail-message.d.ts

@@ -90,6 +90,11 @@ export default class MailMessage<T = SentMessageInfo> {
         [key: string]: any;
     }, key: string | number, options?: ResolveContentOptions | false): Promise<any>;
     resolveAll(callback: MailMessageDataCallback): void;
+    /**
+     * Destroys the content streams of the message once sending failed. A stream that was not
+     * read to the end would otherwise keep the file or the socket behind it open
+     */
+    releaseStreams(): void;
     normalize(callback: MailMessageDataCallback): void;
     setMailerHeader(): void;
     setPriorityHeaders(): void;