DANE: TLSA records for SMTP

Discuss Advanced use case
1

Hi all,

is anyone using Yunohost with TLSA DNS records for SMTP?
DANE is great for better security between SMTP servers.

It would be cool if Yunohost could recommend corresponding TLSA DNS record for SMTP.

Cheers from proud supporter,
Bogdan

2

Great online testing tool for email security: https://internet.nl/

3

I solved it :checkered_flag: and now my domain has 100% score at internet.nl :fireworks:

  1. install another acme client: acme.sh
  2. change postfix main.cf:
#    /etc/yunohost/certs/MYDOMAIN/key.pem,
#    /etc/yunohost/certs/MYDOMAIN/crt.pem
    /root/.acme.sh/MYDOMAIN_ecc/MYDOMAIN.key,
    /root/.acme.sh/MYDOMAIN_ecc/fullchain.cer
  1. restart or reload postfix, test configuration for example with internet.nl
  2. acme.sh in default uses ZeroSSL instead Let’s Encrypt and do not generate new key to reissue, I do not want to setup rollover TLSA process
  3. insert in DNS TLSA record: type 3 1 1, calculate sum:
in_folder_with_acme.sh_crts:# openssl pkey -in MYDOMAIN.key -pubout -outform DER | sha256sum
  1. test configuration for example with internet.nl

Useful links: