Public reconnaissance of North Korean mail infrastructure found reachable Postfix SMTP services for star-co.net.kp and silibank.net.kp on typical mail ports. The Star-CO servers presented a self-managed certificate issued by a North Korean StarJV Certificate Authority, but the certificate subject used mail.nisp.cc rather than a .kp routing domain. The certificate and SMTP configuration showed unusual operational signals, including an X.509 v1 certificate, primitive serial numbering, multiple identities on one host, enabled VRFY and ETRN, a non-standard SMTP extension, and a 10 GB SMTP SIZE limit on active Star-CO servers. The findings matter for DPRK infrastructure tracking because they expose externally reachable mail services, recent certificate and domain activity, and possible design choices separating routing identity from cryptographic identity.