aither/simple-nixos-mailserver
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use postfix-tlspol for DANE/MTA-STS policy lookups

Browse Source 
Postfix with plain DANE only secures domains that configure DNSSEC and
publish TLSA records. With postfix-tlspol we support MTA-STS protected
connections and get caching for its policy results.

Finally, we use this as a stepping stone to build TLSRPT support on top.
This commit is contained in:
Martin Weinelt
2025-06-29 00:57:56 +02:00
parent ed771e37f7
commit 0812ca1e48
4 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
mail-server/postfix.nix
View File

@@ -243,6 +243,12 @@ in
{
config = lib.mkIf cfg.enable {
# SMTP client policy mapping for DANE (RFC 6698) and MTA-STS (RFC 8461)
services.postfix-tlspol = {
enable = true;
configurePostfix = true;
};
systemd.services.postfix-setup = lib.mkIf cfg.ldap.enable {
preStart = ''
${appendPwdInVirtualMailboxMap}
@@ -350,7 +356,7 @@ in
smtpd_tls_exclude_ciphers = "SHA1, eNULL, aNULL";
smtpd_tls_mandatory_exclude_ciphers = "SHA1, eNULL, aNULL";
# Opportunistic DANE support when delivering mail to other servers
# Enable DNSSEC/DANE support for outgoing SMTP connections
# https://www.postfix.org/postconf.5.html#smtp_tls_security_level
smtp_dns_support_level = "dnssec";
smtp_tls_security_level = "dane";