SMTP MTA Strict Transport Security (MTA-STS)

Re:SMTP MTA Strict Transport Security (MTA-STS) by markovbot on Friday September 28, 2018 @06:25PM (#18097566)

So, to set this up for my domain, I have to make a TXT record like this:

  _mta-sts.example.com.     TXT     "v=STSv1; id=20180928;"

Where id is just a unique identifier for the current version of the STS policy, then I configure a webserver to respond to requests for https://mta-sts.example.com/.well-known/mta-sts.txt that looks like this:

  version: STSv1
  mode: testing
  mx: mx1.example.com
  mx: mx2.example.com
  max_age: 86400

Am I understanding this right?

Also, I use postfix to send email, does anyone know how I can make postfix use these policies?

[ Parent | on HN ]

Re:SMTP MTA Strict Transport Security (MTA-STS) by Snawoot on Sunday September 30, 2018 @04:34PM (#18108251)

At this moment there are no MTA-STS support in postfix. But this thread [1] in postfix-users mailing list suggests acceptable solution: use external policy server for MTA-STS discovery. I have implemented such server: package on PyPI [2], source on Github [3]. Works for me.

[1] http://postfix.1071664.n5.nabble.com/MTA-STS-when-td95086.ht... [2] https://pypi.org/project/postfix-mta-sts-resolver/ [3] https://github.com/Snawoot/postfix-mta-sts-resolver

[ Parent | on HN ]

Re:SMTP MTA Strict Transport Security (MTA-STS) by markovbot on Sunday September 30, 2018 @04:41PM (#18108283)

Perfect, thanks!

[ Parent | on HN ]

Re:SMTP MTA Strict Transport Security (MTA-STS) by damm on Friday September 28, 2018 @09:30PM (#18098230)

No changes are required in postfix yet? as it's just published expect updates from Postfix and Exim soon.

[ Parent | on HN ]