On Mon, Jul 08, 2024 at 03:02:35PM +0200, Wolfgang via Exim-users wrote: > >Perhaps the issue is as mundane as you not having a local validating > >resolver in /etc/resolv.conf, so that the destination domain looks > >unsigned to Exim? Can you post the output of: > > > $ dig +noall +stats +comment -t mx et.lindenberg.one | grep -E '^;; > > (flags|SERVER):' > > >On my system, I see: > > > $ dig +noall +stats +comment -t mx et.lindenberg.one | grep -E '^;; > > (flags|SERVER):' > > ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 > > ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) > >Note the "ad" bit in the response *flags*, and "127.0.0.1" for the > >*SERVER*. I have a validating local resolver. > > I checked into that already also. First I used my own nameserver, > where the output just looks as yours. > dig +noall +stats +comment -t mx et.lindenberg.one | grep -E '^;; > (flags|SERVER):' > ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 > ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
But does *glibc* strip the AD bit when processing the response? Do you have "options trust-ad" in /etc/resolv.conf? > But later I changed to to the nameservers from my hoster, where the output > looks like this: > dig +noall +stats +comment -t mx et.lindenberg.one | grep -E '^;; > (flags|SERVER):' > ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 6 > ;; SERVER: 185.12.64.1#53(185.12.64.1) (UDP) And DANE is pretty pointless if you're trusting the AD from a server far away. To get meaningful security, you need a server you control that you can reach via the loopback interface or a "very private" LAN. > So that can't be the cause from my knowledge point. Do you have evidence that Exim is actually configured to use DANE, do you have <https://packages.debian.org/search?keywords=libgnutls-dane0> installed? Does anything in the logs indicate that DANE is attempted? > >DANE is not actually taking place. > > All I can see is, that DANE takes place (for the OpenSSL based exim), > as I pass the test from https://blog.lindenberg.one/EmailSecurityTest But you also reported that the OpenSSL version did not send SNI, which is not consistent with that claim. -- Viktor. -- ## subscription configuration (requires account): ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/ ## unsubscribe (doesn't require an account): ## exim-users-unsubscr...@lists.exim.org ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
