Closed Frederick888 closed 4 years ago
Hello!
This is expected and documented behaviour.
Long story short: MTA-STS standard implies MTA has to support SNI. Otherwise there may be issues with TLS connectivity leading to permanent delivery failure to domains using multiple certificates on single MX address. Postfix prior to 3.4 doesn't support SNI at all. Postfix 3.4+ has SNI support, but doesn't send it by default. In order to comply with RFC 8461, postfix-mta-sts-resolver 1.0.0+ instructs Postfix 3.4+ to send server name indication with each returned valid STS policy.
This change was introduced in postfix-mta-sts-resolver version 1.0.0 and correct behaviour is enabled by default.
Only completely valid configuration for MTA-STS (from standards point of view) is Postfix 3.4+ and postfix-mta-sts-resolver 1.0.0 and above.
There are two ways for you to resolve this issue:
SNI requirement can be disabled in your mta-sts-daemon.yml with require_sni
option like this:
--- a/mta-sts-daemon.yml
+++ b/mta-sts-daemon.yml
@@ -11,3 +11,4 @@ cache:
default_zone:
strict_testing: false
timeout: 4
+ require_sni: false
Ah, I was wondering why it suddenly started to fail. Thanks a lot for the quick response!
Hi! I have same issue with gmail.com and mail.ru, but i added require_sni: false.
My environment:
Linux CentOS x64 7.9.2009 + last upd
Postfix 2.10.1 (postfix.x86_64 2:2.10.1-9.el7)
Installation method 4. Docker. Run:
docker run -d --security-opt no-new-privileges -v /etc/postfix/mta-sts-cfg.yml:/etc/mta-sta-daemon.yml -v mta-sts-cache:/var/lib/mta-sts -p 127.0.0.1:8461:8461 --restart unless-stopped --name postfix-mta-sts-resolver yarmak/postfix-mta-sts-resolver
/etc/postfix/mta-sts-cfg.yml
host: 0.0.0.0
port: 8461
reuse_port: true
shutdown_timeout: 20
cache:
type: sqlite
options:
filename: "/var/lib/mta-sts/cache.db"
default_zone:
strict_testing: false
timeout: 4
require_sni: false
Sorry my English...
Hi!
@xcodxcod
Please check if you are running latest version of docker image.
Please tell me output of following command:
/usr/sbin/postmap -q gmail.com socketmap:inet:127.0.0.1:8461:test
# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
yarmak/postfix-mta-sts-resolver latest cda7cbfb8cb5 6 months ago 72MB
/usr/sbin/postmap -q gmail.com socketmap:inet:127.0.0.1:8461:test
secure match=gmail-smtp-in.l.google.com:.gmail-smtp-in.l.google.com servername=hostname
@xcodxcod
Thanks! You have typo in your docker command: /etc/mta-sta-daemon.yml. Correct option will look like this: -v /etc/postfix/mta-sts-cfg.yml:/etc/mta-sts-daemon.yml
Describe the bug Postfix shows
client TLS configuration problem
when sending emails to google.com andpostfix-mta-sts-resolver
is enabled.To Reproduce Steps to reproduce the behavior:
postfix-mta-sts-resolver
client TLS configuration problem
and emails are deferredExpected behavior No errors.
Output listings Postfix configuration:
postfix-mta-sts-resolver
(Docker) configuration:Postfix logs:
postfix-mta-sts-resolver
logs:Redis:
Tests:
Environment (please complete the following information):
yarmak/postfix-mta-sts-resolver
ba7ca013cc35)3.3.0-1ubuntu0.2