Adding MTA-STS on outbound postfix.

Eericty · Aug 9, 2022

So I’m currently running this docker image: GitHub - Snawoot/postfix-mta-sts-resolver: Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy

GitHub

GitHub - Snawoot/postfix-mta-sts-resolver: Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy

Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy - Snawoot/postfix-mta-sts-resolver

It’s working great, though I noticed this morning that I had not started the image until after a reboot.
Basically, it checks whether a domain has implemented MTA-STS and uses a postfix tls transport to verify. It works great in all honesty, and I would suggest being added as a mailcow docker pull.
There is no reporting that I’m aware of, so if the devs want to help out, I’m sure it would be appreciated by the developer.

If anyone is wondering, it’s a pretty simple install.

git clone and create storage
add “smtp_tls_policy_maps = socketmap:inet:$HOST:8461:postfix” to extra.cf
start up docker image and add to mailcowdockerized_mailcow-network
restart postfix-mailcow image

DD4niel · Aug 10, 2022

There was already a discussing about implementing something like that: mailcow/mailcow-dockerized2747

JJoachim · Aug 10, 2022

I think anyone serious with Email security should implement DNSSEC and go for RFC 7672 (SMTP with DANE) (set postfix smtp_tls_security_level to dane).