[DANE] - Update postfix to check TLSA when sending emails to remote servers. #755

New Issue

Closed

opened 2024-01-10 22:37:07 +01:00 by muppeth · 1 comment

muppeth commented

2024-01-10 22:37:07 +01:00

Owner

No description provided.

muppeth added this to the 24.01 - January milestone 2024-01-10 22:37:07 +01:00

muppeth added the

Mail

label 2024-01-10 22:37:07 +01:00

muppeth self-assigned this 2024-01-10 22:37:07 +01:00

muppeth commented

2024-01-10 22:40:33 +01:00

Author

Owner

Done in prod and PR made. This update forces postfix to check validity of existing TLSA record when sending email and if invalid do not send.

Currently check is set to smtp_tls_security_level = dane for backward compatibility with non-dane enabled domains which is the right way to do it (not everyone does implement it), as it won't send emails to servers with invalid TLSA.

Done in prod and PR made. This update forces postfix to check validity of existing TLSA record when sending email and if invalid do not send. Currently check is set to `smtp_tls_security_level = dane` for backward compatibility with non-dane enabled domains which is the right way to do it (not everyone does implement it), as it won't send emails to servers with invalid TLSA.

muppeth closed this issue

2024-01-10 22:40:33 +01:00

muppeth referenced this issue

2024-02-22 12:49:58 +01:00

[Email] - Enforce TLS for postfix #798