hmLoadTopic({
hmKeywords:"SMTP Extensions,SMTP Extensions,SMTP Extensions MTA-STS,SMTP Extensions REQUIRETLS,SMTP Extensions TLS Reporting,SSL & TLS,SSL & TLS SMTP Extensions",
hmTitle:"SMTP Extensions",
hmDescription:"SMTP Extensions Enable REQUIRETLS (RFC 8689) RequireTLS allows you to flag messages that must be sent using TLS. If TLS is not possible (or if the parameters of the TLS certifi",
hmPrevLink:"ssl_starttls-required-list.html",
hmNextLink:"ssl_dnssec.html",
hmParentLink:"ssl__certificates.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; <a href=\"ssl__certificates.html\">SSL &amp; TLS<\/a>",
hmTitlePath:"Security Menu > Security Manager > SSL & TLS > SMTP Extensions",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">SMTP Extensions<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5000rem;height:24.5000rem;border:none\" src=\".\/images\/ssl-tls_smtp_extensions.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SMTP Extensions<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable REQUIRETLS (RFC 8689)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">RequireTLS allows you to flag messages that <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">must<\/span><span class=\"f_ControlIndent\"> be sent using TLS. If TLS is not possible (or if the parameters of the TLS certificate exchange are unacceptable) messages will be bounced rather than delivered insecurely. For a complete description of RequireTLS, see: <a href=\"https:\/\/tools.ietf.org\/html\/rfc8689\" target=\"_blank\" class=\"weblink\" title=\"SMTP Require TLS Option\">RFC 8689: SMTP Require TLS Option<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">RequireTLS is enabled by default, but the only messages that will be subject to the RequireTLS process are messages specifically flagged by a Content Filter rule using the new <a href=\"cf_creating_a_new_content_filter_rule.html\" class=\"topiclink\">Content Filter action<\/a>, &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Flag message for REQUIRETLS...<\/span><span class=\"f_ControlIndent\">&quot;, or messages sent to <\/span><span class=\"f_PlainText\">&lt;local-part&gt;+requiretls@domain.tld<\/span><span class=\"f_ControlIndent\"> (for example, <\/span><span class=\"f_PlainText\">arvel+requiretls@mdaemon.com<\/span><span class=\"f_ControlIndent\">). All other messages are treated as if the service is disabled. Several requirements must be met in order for a message to be sent using RequireTLS. If any of them fail, the message will bounce back rather than be sent in the clear. The requirements are:<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">RequireTLS must be enabled.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">The message must be flagged as needing the RequireTLS treatment, via the Content Filter action or the &quot;<\/span><span class=\"f_PlainText\">&lt;localpart&gt;+requiretls@...<\/span><span class=\"f_List12\">&quot; address.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">DNS lookups for recipient MX hosts must use <a href=\"ssl_dnssec.html\" class=\"topiclink\">DNSSEC<\/a> (see below), or the MX must be validated by MTA-STS.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">The connection to the receiving host must use SSL (STARTTLS).<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">The SSL certificate of the receiving host must match the MX host name and chain to a trusted CA.<\/span><\/p>\n\r<p class=\"p_List12_LastItem\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.7500rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12_LastItem\">The receiving mail server must support REQUIRETLS and say so in the EHLO response.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">RequireTLS requires DNSSEC lookups of MX record hosts, or the MX must be validated by MTA-STS. You can <a href=\"ssl_dnssec.html\" class=\"topiclink\">configure DNSSEC<\/a> by specifying criteria whereby lookups will request DNSSEC service. MDaemon\'s <a href=\"ip-cache.html\" class=\"topiclink\">IP Cache<\/a> has an option for accepting DNSSEC assertions, and there are DNSSEC related instructions at the top of the <a href=\"default-domain-and-servers_dns.html\" class=\"topiclink\">MX Hosts file<\/a>. Finally, DNSSEC requires appropriately configured DNS servers, which is beyond the scope of this help file.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><a id=\"mta-sta\" class=\"hmanchor\"><\/a><span class=\"f_ControlHeading\">Enable<\/span><span class=\"f_ControlHeading\"> MTA-STS (RFC 8461)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">MTA-STS support is enabled by default and is described in <a href=\"https:\/\/tools.ietf.org\/html\/rfc8461\" target=\"_blank\" class=\"weblink\" title=\"SMTP Require TLS Option\">RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">SMTP MTA Strict Transport Security (MTA-STS) is a mechanism enabling mail service providers (SPs) to declare their ability to receive Transport Layer Security (TLS) secure SMTP connections and to specify whether sending SMTP servers should refuse to deliver to MX hosts that do not offer TLS with a trusted server certificate. To set up MTA-STS for your own domain, you will need an MTA-STS policy file that can be downloaded via HTTPS from the URL https:\/\/mta-sts.domain.tld\/.well-known\/mta-sts.txt, where &quot;domain.tld&quot; is your domain name. The policy text file should contain lines in the following format: <\/span><\/p>\n\r<p class=\"p_Code\" style=\"margin: 0 0 0 3.7500rem;\"><span class=\"f_Code\">version: STSv1<\/span><\/p>\n\r<p class=\"p_Code\" style=\"margin: 0 0 0 3.7500rem;\"><span class=\"f_Code\">mode: testing<\/span><\/p>\n\r<p class=\"p_Code\" style=\"margin: 0 0 0 3.7500rem;\"><span class=\"f_Code\">mx: mail.domain.tld<\/span><\/p>\n\r<p class=\"p_Code_LastItem\" style=\"margin: 0 0 0.7500rem 3.7500rem;\"><span class=\"f_Code_LastItem\">max_age: 86400<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Mode can be &quot;none&quot;, &quot;testing&quot;, or &quot;enforce&quot;. There should be an &quot;mx&quot; line for each of your MX hostnames. A wildcard can be used for subdomains, such as &quot;*.domain.tld&quot;. Max age is in seconds. Common values are 86400 (1 day) and 604800 (1 week). <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Also needed is a DNS TXT record at _mta-sts.domain.tld, where &quot;domain.tld&quot; is your domain name. It must have a value in the format: <\/span><\/p>\n\r<p class=\"p_Code_LastItem\" style=\"margin: 0 0 0.7500rem 3.7500rem;\"><span class=\"f_Code_LastItem\">v=STSv1; id=20200206T010101;<\/span><span class=\"f_ControlIndent\"> <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The value for &quot;id&quot; must be changed every time the policy file is changed. It is common to use a timestamp for the id.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_List1\">Use this list to make specific domains exempt from MTA-STS.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Cache<\/span><span class=\"f_ControlHeading2\"> MTA-STS DNS records<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default MDaemon caches MTA-STS DNS records. Click <\/span><span class=\"f_ControlIndent2\" style=\"font-weight: bold;\">Edit<\/span><span class=\"f_ControlIndent2\"> to view or edit the current cache file.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><a id=\"tls_reporting\" class=\"hmanchor\"><\/a><span class=\"f_ControlHeading\">Enable TLS Reporting (RFC 8460)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">TLS Reporting is disabled by default and discussed in <a href=\"https:\/\/tools.ietf.org\/html\/rfc8460\" target=\"_blank\" class=\"weblink\" title=\"SMTP Require TLS Option\">RFC 8460: SMTP TLS Reporting<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">TLS Reporting allows domains using MTA-STS to be notified about any failures to retrieve the MTA-STS policy or negotiate a secure channel using STARTTLS. When enabled, MDaemon will send a report daily to each STS-enabled domain that it has sent (or attempted to send) mail to that day. There are several options provided for configuring the information that your reports will contain. <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">To set up TLS Reporting for your domain, enable <a href=\"security--dkim_sign.html\" class=\"topiclink\">DKIM signing<\/a>, and create a DNS TXT record at <\/span><span class=\"f_PlainText\">_smtp._tls.domain.tld<\/span><span class=\"f_ControlIndent\">, where &quot;domain.tld&quot; is your domain name, with a value in the format:<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_PlainText\">v=TLSRPTv1; rua=mailto:mailbox@domain.tld<\/span><span class=\"f_ControlIndent\"> <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Where mailbox@domain.tld is the email address where you want reports for your domain to be sent. <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r<p style=\"text-indent: -1.4375rem; margin: 0.3125rem 0.5625rem 1.5000rem 3.0000rem;\"><span style=\"font-family: Arial,Helvetica,sans-serif; color: #000000;\">&nbsp;<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r"
})
