How to test successful postfix-mta-sts-resolver setup? about postfix-mta-sts-resolver

[Snawoot]

Hello,

This is already covered for Postfix in README: https://github.com/Snawoot/postfix-mta-sts-resolver#operability-check

I'm not sure about Sendmail because I've never tried it with pmsr and integration with pmsr in Sendmail is relatively new. I'll leave this issue open, maybe other people may suggest any difference in logs which or anything what allows to validate correctness of setup.

[dilyanpalauzov]

To validate the lookup in sendmail one has to call

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> /map sts github.com
map_lookup: sts (github.com) no match (68)
> /map sts microsoft.com
map_lookup: sts (microsoft.com) returns secure match=.mail.protection.outlook.com servername=hostname (0)
> 

My question was rather about a site, which on purpose has misconfigured its MTA-STS setup. Thus, when a sender has properly configured MTA-STS for outbound mails, writing to that site will fail.

[Snawoot]

@dilyanpalauzov Ah, now I get it. I also was collaborating with STARTTLS Everywhere project, there was an idea to build something like https://badssl.com/ but for MTA-STS. It was never implemented, though. Would be nice if somebody will make it.

[dilyanpalauzov]

I raised the question on the ietf-smtp maling list - https://mailarchive.ietf.org/arch/msg/ietf-smtp/59u831ZQlnhGhTmmmcxDwboxZyk/ .