On Sat, Jun 13, 2020 at 06:24:02PM +0200, Ján Máté wrote: > but I found the problem and it will be hard to fix. Postfix TLS code sends > SNI only for DANE
Actually, SNI is also sent when the policy table has a non-empty setting for the "servername" keyword: http://www.postfix.org/TLS_README.html#client_tls_policy may Opportunistic TLS. The optional "ciphers", "exclude" and "protocols" attributes (available for opportunistic TLS with Postfix ≥ 2.6) override the "smtp_tls_ciphers", "smtp_tls_exclude_ciphers" and "smtp_tls_protocols" configuration parameters. At this level and higher, the optional "servername" attribute (available with Postfix ≥ 3.4) overrides the global "smtp_tls_servername" parameter, enabling per-destination configuration of the SNI extension sent to the remote SMTP server. > postfix-mta-sts-resolver return value for "smtp_tls_policy_maps" is "secure > match=smtp.infcloud.com": If the MTA-STS policy table service overrides DANE policy in the presence of TLSA records for the domain, then it is broken. If however, DANE records are not present, then the MTA-STS service MUST instead return one of: verify servername=hostname or secure servername=hostname match=hostname The only difference (a mistake on my part in retrospect) between "verify" and "secure" is that "secure" defaults to matching the "nexthop" domain, while "verify" defaults to matching the MX "hostname". These cases should probably not have been two separate levels. > and postfix does not send SNI if smtp_tls_security_level is "secure". By default, for backwards compatibility, but it does if either there's a policy setting for "servername" or "smtp_tls_servername" is set in main.cf. http://www.postfix.org/postconf.5.html#smtp_tls_servername > So the question is rather simple - how to force Postfix to use SNI for > "secure" smtp_tls_security_level only. Fix the MTA-STS socketmap server to return the requisite (i.e. "hostname") setting for the "servername" policy parameter. > And the good solution is maybe to add another security level called > "secure-sni", which will send SNI as required by MTA-STS. Not needed. -- Viktor.