Re: Followup to your reply on the IETF-SMTP mailing list
Viktor Dukhovni <[email protected]>
| Newsgroups | gmane.ietf.smtp |
|---|---|
| Message-ID | <[email protected]> |
On Tue, May 25, 2021 at 12:40:01PM +0200, Kaspar Etter wrote: > On 24 May 2021, at 12:43, Alessandro Vesely <[email protected]> wrote: > >> And the beauty of TLSA records is that the MX operator maintains them. All I > >> have to do as a domain owner is to deploy/enable DNSSEC on my domain. > > > > You're right. I assumed the TLSA record was not a CNAME. I guess you mean: > > > > _25._tcp.my-domain.example. IN CNAME _25._tcp.MX-operator.example. > > No, I meant that DANE-aware ESMTP clients first resolve the MX > indirection and look for TLSA records on the “target/MX” domain. Indeed, e.g. this is how it works form ~1.2 million domains that are MX-hosted by one.com MX hosts. The hosted domain just needs to be DNSSEC-signed and to point its MX records at the provider. The DANE TLSA RRs and all responsibility for managing them are on the MX host side: simonvikstrom.se. IN MX 10 mx1.pub.mailpod7-cph3.one.com. ; NoError AD=1 simonvikstrom.se. IN MX 10 mx2.pub.mailpod7-cph3.one.com. ; NoError AD=1 simonvikstrom.se. IN MX 10 mx3.pub.mailpod7-cph3.one.com. ; NoError AD=1 ; mx1.pub.mailpod7-cph3.one.com. IN A 185.164.14.86 ; NoError AD=1 _25._tcp.mx1.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 3b8e75c279f1dda9ca462b79077ba25b63f4a016d01e3fbbca6ab6620ae04421 ; NoError AD=1 _25._tcp.mx1.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 ab91ea8a9ae477de45828410679aa1e6c290b3a28835f47e3eac9d0bd1894c2f ; NoError AD=1 ; mx2.pub.mailpod7-cph3.one.com. IN A 185.164.14.87 ; NoError AD=1 _25._tcp.mx2.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 3b8e75c279f1dda9ca462b79077ba25b63f4a016d01e3fbbca6ab6620ae04421 ; NoError AD=1 _25._tcp.mx2.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 ab91ea8a9ae477de45828410679aa1e6c290b3a28835f47e3eac9d0bd1894c2f ; NoError AD=1 ; mx3.pub.mailpod7-cph3.one.com. IN A 185.164.14.88 ; NoError AD=1 _25._tcp.mx3.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 3b8e75c279f1dda9ca462b79077ba25b63f4a016d01e3fbbca6ab6620ae04421 ; NoError AD=1 _25._tcp.mx3.pub.mailpod7-cph3.one.com. IN TLSA 3 1 1 ab91ea8a9ae477de45828410679aa1e6c290b3a28835f47e3eac9d0bd1894c2f ; NoError AD=1 -- Viktor. _______________________________________________ ietf-smtp mailing list [email protected] https://www.ietf.org/mailman/listinfo/ietf-smtp