Issue Description
When sending an email to a recipient domain protected by a MTA-STS policy the MX/MTAhost certificate is not validated as required in RFC 8461 Section 4.2 but only opportunistic TLS encryption is enforced.
Expected Behavior
The email should fail to be delivered when the recipient mailserver does not present a matching (DNS SAN to MX and time valid, as well as chaining up to a locally trusted CA) TLS certificate. An NDR as well as a TLS report should be sent.
Actual Behavior
The mail is tried to deliver and StartSSL fails due to the invalid certificate. It is then rescheduled to be sent via the tls-invalid TLS strategywhich allows invalid certificates even for MTA-STS protected domains
Reproduction Steps
Set stalwart TLS Strategy MTA-STS to optional or required. Send a mail to measurement@mail-mtasts-rn-iv.measurement.email-security-scans.org
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
RocksDB
Blob Storage
Filesystem
Search Engine
Internal
Directory Backend
OIDC
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
Edit: Further observation:
When checking the documentation at MTA-STS | Stalwart I came to the conclusion that this is extruded/generated text and not checked by anyone knowing about MTA-STS. I conclude this from this sentence: “The receiving email server will retrieve the MTA-STS policy statement and verify that the incoming connection meets the security requirements specified in the policy.” → First this isn’t how it’s done at all (inbound vs outbound, policy doesn’t specify security requirements etc.) and second it’s useless for anyone configuring stalwart and referring to the documentation, as it does not explain how it is implemented within stalwart.
Please don’t take this last part as negative feedback on stalwart or the people working on it. It’s just feedback for you to consider when writing documentation as what can happen and what is helpful (or counterproductive) for the users.