Receiving HISP — outbound MDNs not registering (MDN-Received); please load our trust anchor — direct@vallum.spheretechnology.com

[Will Fein]

We're certifying ONC 170.315(h)(1) as a self-hosted receiving HISP. Inbound Direct messages are received, decrypted, and ingested correctly, and we return RFC 3798 MDNs. The MDNs are properly wrapped (message/rfc822), S/MIME signed, and encrypted to ETT's certificate, sent back to the message's mail-from, with Original-Message-ID matching the inbound message exactly. ETT receives them (external delivery confirmed), but the messages stay WAITING and never flip to MDN-Received - which points to ETT being unable to verify our signature because our trust anchor is not loaded on the ETT side.

Direct address: dir...@vallum.spheretechnology.com

Example: inbound message <546911423.314.1781901289976@localhost> from ccd...@ett.healthit.gov - we returned Processed + Dispatched MDNs that are not registering.

Our certificate (attached, PEM): self-signed CA, RSA-2048, SHA-256, with SKI and AKI present (SKI 6B:2F:F1:F4:B3:67:53:6E:A2:8B:DA:25:20:B9:86:C2:2B:AE:70:91), email SAN dir...@vallum.spheretechnology.com, valid to 2027-07-21. It is also published as a DNS CERT record at direct.vallum.spheretechnology.com (address-bound) and vallum.spheretechnology.com (domain-bound).

Could you please (1) load our trust anchor on the ETT side, and (2) check your logs for the reason our MDNs are not being accepted? Happy to provide anything else you need.

Thank you.

[Will Fein]

Hi ETT team — following up on my June 19 request, which hasn't been actioned yet. We now have Drummond certification testing scheduled imminently and this is our last blocking item, so I'd greatly appreciate a same-day look. Two items:

1. Please load our trust anchor (attached, re-sent) into the ett.healthit.gov trust store.
- Domain: vallum.spheretechnology.com · Direct address: dir...@vallum.spheretechnology.com
- Self-signed CA, RSA-2048/SHA-256, serial E41CACDFC2AA1015, valid to 2027-07-21
- Needed for: Send Direct Message (senddirect) MDN status tracking and SMTP MT Tests 39, 40, 41
- Fresh evidence for your logs — on 2026-07-20 we received Good Cert Amb from ccd...@ett.healthit.gov (Message-ID <1286052004.416.1784546073367@localhost>, ~11:14 UTC), decrypted and processed it, and returned Processed and Dispatched MDNs at 11:15:27–28 UTC, which your MX accepted (no bounces). The senddirect Message Status still shows WAITING — consistent with our anchor missing from your store, so our MDN signatures can't be verified.
- Note we have already self-service-uploaded our anchor to the direct.site.healthit.gov sandbox bundle via the Transport Test Tool — that side works. It's specifically the ett.healthit.gov store that needs the manual load.

2. SMTP MT Test 39 is erroring on the ETT side — this looks like a recurrence of the outage in this thread (previously fixed 7/29/25, 9/9/25, 12/30/25, 5/26/26):

▎ Error in TEST MESSAGE DISPOSITION NOTIFICATIOt, port: direct.ett.healthit.gov, 25; timeout -1

Hit on 2026-07-20 ~11:30 UTC. Could you restart/check direct.ett.healthit.gov:25?

Happy to re-test within minutes of either fix — we've verified our full pipeline end-to-end this week and everything on
our side responds in under 60 seconds.

Thanks,
Will Fein · Sphere Technology · dir...@vallum.spheretechnology.com

[Sai Valluripalli]

Hello,

Trust anchor is uploaded to ETT. Please test now.

--
You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/eab90a5f-a77d-43c4-a8b8-9f9164d3344dn%40googlegroups.com.