2 ms·
You've been able to configure Postfix to verify TLS for ages; you don't need some new daemon for that. I've written plenty of email systems over the years and h
by Beltalowda 4y ago
You've been able to configure Postfix to verify TLS for ages; you don't need some new daemon for that. I've written plenty of email systems over the years and have always verified certificates (unless explicitly told not to by the user) and that works just fine.
You're confusing a lot of things that are related but actually quite distinct. That DigitalOcean article talks about STARTTLS, but that's something different than SMTP over TLS. I haven't worked that much with email in the last few years so haven't looked at MTA-STS in detail, but it just seems similar to setting a "always require a TLS connection"; that new Postfix service just looks up the DNS records and such; it's not required for TLS functionality.
- Avamander 4y agoOkay, you configure Postfix to verify TLS. Validation fails, what will happen? What does the documentation say about that configuration option? That aside, an active attacker can also trivially force a downgrade. Only with the introduction of MTA-STS, connections between MTA-MTA are secure. That's supported by, like, few major players - I guess by volume a fine percentage, but by total count, abysmal.