search

corecode / dma

The DragonFly Mail Agent, a small Mail Transport Agent (MTA), designed for home and office use.
Other
235 stars 51 forks source link

Verify smarthost's certificate #132

Closed rianhunter closed 1 year ago

rianhunter commented 1 year ago

Per #129

After implementing the code I realized that the TLS code path is also invoked when connecting to MX hosts and not just smarthosts. In that case, I agree with you that forcing verification on MX hosts doesn't make much sense since that isn't under the user's control. I think verifying smarthosts by default always makes sense though so that's what I implemented here. Let me know what you think.

As an aside, the configuration option for STARTTLS should only apply to smarthosts as well, since you must use STARTTLS with MX hosts. I didn't implement that here, just noticed it. Maybe even more generally, the TLS options should only apply for the smarthost. For MX hosts, TLS should be used and verified on a per-domain basis (i.e. whitelist TLS for domains like gmail.com, yahoo.com, etc.) since we know those support TLS.

corecode commented 1 year ago

I think we should invert the setting and use VERIFYCERT, because otherwise we will break setups where the smarthost is using a self-signed certificate (like I used to for a long time).

rianhunter commented 1 year ago

Addressed your feedback. Just FYI, I added this as a new commit but I'm expecting you to squash and merge.

corecode commented 1 year ago

feel free to merge any time (also any other commit. of course you can open PRs for review.)