Comcast Shot Themselves in the Foot with MTA-STS

Re:Comcast Shot Themselves in the Foot with MTA-STS by Byteflux on Wednesday January 19, 2022 @02:45PM (#29998955)

For sure. It's not trivial but I also wouldn't say it's difficult either, maybe more of a moderate difficulty? The policy file format is straight forward, as are the necessary TXT and CNAME records.

In my case, I use Cloudflare for my domain so I set up a Cloudflare Pages project to generate and host the policy file at the mta-sts subdomain which is nice because I don't have to worry about hosting or SSL/TLS.

As long as your provider supports MTA-STS, you're only on the hook for setting up the records and hosting the policy file.

[ Parent | on HN ]

Re:Comcast Shot Themselves in the Foot with MTA-STS by agwa on Wednesday January 19, 2022 @02:55PM (#29999119)

If you never make changes, that will work once it's set up.

But if you ever decide to change your mail provider, you'll have to remember to correctly update your MTA-STS policy. If your change to Cloudflare Pages doesn't propagate through the Cloudflare CDN right away, you could end up in the situation described in the blog post, with the TXT record updated before the text file, and other mail servers unable to send you email.

[ Parent | on HN ]