nuc: alerting works — zed -> mail -> msmtp -> submission(587)

Records the working chain and the two dead ends: port 25 gets the mail
rspamd-rejected (dynamic home IP, no SPF alignment), and the missing
PTR delays the 587 greeting enough that short-timeout probes look like
a firewall block. Credentials live only in /etc/msmtprc (600).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nuc/usb4t-dropouts.md

@@ -64,22 +64,43 @@ Damage from the 2026-08-28 incident: two pool-metadata objects
 ## Alerting (why nobody noticed for 11 days)
 
 `zfs-zed` was installed, enabled and running — but the host had **no
-MTA**, so its notifications went nowhere. Fixed 2026-08-28:
+MTA**, so its notifications went nowhere for 11 days. Fixed
+2026-08-28; the working chain is:
 
-- `apt install msmtp msmtp-mta bsd-mailx` — `sendmail` is now msmtp,
-  `mail` (bsd-mailx) is what ZED calls.
-- `/etc/msmtprc` (mode 600): SMTP relay account. **Contains
-  `CHANGEME` placeholders — fill host/user/password/from.**
-  It also resolves `/etc/aliases`, where `root:` points at the real
-  mailbox (placeholder too).
-- `/etc/zfs/zed.d/zed.rc`: `ZED_EMAIL_ADDR`, `ZED_EMAIL_PROG="mail"`,
-  `ZED_EMAIL_OPTS`, `ZED_NOTIFY_VERBOSE=1` (so scrub results and
-  resilvers are reported, not just failures),
-  `ZED_NOTIFY_INTERVAL_SECS=3600`. Original kept as `zed.rc.orig`.
+```
+zed → mail (bsd-mailx) → /usr/sbin/sendmail = msmtp → mail.lutran.fr:587 (auth, STARTTLS)
+```
 
-Test once the credentials are in:
+- `apt install msmtp msmtp-mta bsd-mailx`
+- **`/etc/msmtprc` (mode 600) holds the SMTP account** — host
+  `mail.lutran.fr`, port **587 (submission)**, user `zed@lutran.fr`,
+  STARTTLS, `aliases /etc/aliases`.
+- `/etc/zfs/zed.d/zed.rc` (mode 600): `ZED_EMAIL_ADDR="julien@lutran.fr"`,
+  `ZED_EMAIL_PROG="mail"`, `ZED_EMAIL_OPTS="-s '@SUBJECT@' @ADDRESS@"`,
+  `ZED_NOTIFY_VERBOSE=1` (so scrub/resilver results are mailed too, not
+  only failures), `ZED_NOTIFY_INTERVAL_SECS=3600`. Original kept as
+  `zed.rc.orig`. **No credentials in this file** — they live only in
+  `/etc/msmtprc`.
+
+Two dead ends worth remembering:
+
+- **Port 25 is the wrong port for alerts.** Authentication succeeds,
+  then rspamd rejects the message: `554 5.7.1 Spam message rejected` —
+  a short mail from a dynamic home IP with no SPF alignment scores
+  badly on the inbound MX path. Submission (587) does not apply those
+  rules.
+- **The home IP has no PTR**, so postfix's reverse lookup delays the
+  587 greeting by several seconds. Probes with short timeouts look
+  like a firewall block (`lost connection after CONNECT, commands=0/0`
+  in the server log) — give SMTP tests ≥30 s before concluding
+  anything.
+
+Verify:
 
 ```sh
-echo "zed test $(date)" | mail -s "nuc alert test" root
-tail -5 /var/log/msmtp.log
+echo "test $(date)" | mail -s "nuc alert test" julien@lutran.fr
+tail -2 /var/log/msmtp.log          # expect smtpstatus=250
 ```
+
+End-to-end proof: with `ZED_NOTIFY_VERBOSE=1`, the next scrub
+completion arrives as a mail by itself.