Postfix client TLS configuration problem when sending emails to google.com about postfix-mta-sts-resolver

[Frederick888]

Ah, I was wondering why it suddenly started to fail. Thanks a lot for the quick response!

[Snawoot]

Hello!

This is expected and documented behaviour.

Long story short: MTA-STS standard implies MTA has to support SNI. Otherwise there may be issues with TLS connectivity leading to permanent delivery failure to domains using multiple certificates on single MX address. Postfix prior to 3.4 doesn't support SNI at all. Postfix 3.4+ has SNI support, but doesn't send it by default. In order to comply with RFC 8461, postfix-mta-sts-resolver 1.0.0+ instructs Postfix 3.4+ to send server name indication with each returned valid STS policy.

This change was introduced in postfix-mta-sts-resolver version 1.0.0 and correct behaviour is enabled by default.

Only completely valid configuration for MTA-STS (from standards point of view) is Postfix 3.4+ and postfix-mta-sts-resolver 1.0.0 and above.

There are two ways for you to resolve this issue:

• (Preferred) Upgrade to Postfix 3.4 and above.
• Set postfix-mta-sts-resolver to not require SNI.

SNI requirement can be disabled in your mta-sts-daemon.yml with require_sni option like this:

--- a/mta-sts-daemon.yml
+++ b/mta-sts-daemon.yml
@@ -11,3 +11,4 @@ cache:
 default_zone:
   strict_testing: false
   timeout: 4
+  require_sni: false

[xcodxcod]

Hi!
I have same issue with gmail.com and mail.ru, but i added require_sni: false.

My environment:

Linux CentOS x64 7.9.2009 + last upd
Postfix 2.10.1 (postfix.x86_64 2:2.10.1-9.el7)

Installation method 4. Docker.
Run:

docker run -d --security-opt no-new-privileges -v /etc/postfix/mta-sts-cfg.yml:/etc/mta-sta-daemon.yml -v mta-sts-cache:/var/lib/mta-sts -p 127.0.0.1:8461:8461 --restart unless-stopped --name postfix-mta-sts-resolver yarmak/postfix-mta-sts-resolver

/etc/postfix/mta-sts-cfg.yml

host: 0.0.0.0
port: 8461
reuse_port: true
shutdown_timeout: 20
cache:
  type: sqlite
  options:
    filename: "/var/lib/mta-sts/cache.db"
default_zone:
  strict_testing: false
  timeout: 4
  require_sni: false

Sorry my English...

[Snawoot]

Hi!

@xcodxcod

Please check if you are running latest version of docker image.

Please tell me output of following command:

/usr/sbin/postmap -q gmail.com  socketmap:inet:127.0.0.1:8461:test

[xcodxcod]

# docker images

REPOSITORY                        TAG                 IMAGE ID            CREATED             SIZE
yarmak/postfix-mta-sts-resolver   latest              cda7cbfb8cb5        6 months ago        72MB

/usr/sbin/postmap -q gmail.com socketmap:inet:127.0.0.1:8461:test
secure match=gmail-smtp-in.l.google.com:.gmail-smtp-in.l.google.com servername=hostname

[Snawoot]

@xcodxcod

Thanks! You have typo in your docker command: /etc/mta-sta-daemon.yml. Correct option will look like this: -v /etc/postfix/mta-sts-cfg.yml:/etc/mta-sts-daemon.yml