Re: [dane] Delivery of email if MX is not signed

[Paul Wouters <[e-mail]>]

On Sun, 23 Aug 2015, Patrik Fältström wrote:

> Also, in my example the RRSet the MX is in is _unsigned_:
>
> example.com. IN MX 0 mail.example.net.
>
> 2. Delivery of the mail over TLS to mail.example.net.

so example.com is unsigned? and mail.example.net is signed, and the TLSA
record in example.net is signed.

In that case, I believe TLS will be used but the TLSA cannot be
verified, so while delivery happens over TLS, there is no way to
verify the identity of the receiver because the MX record could have
been spoofed.

I think you are arguing that it should deliver TLS only after validation
of the TLSA record for mail.example.net. That validation is a false
sense of security though.

I don't think mail delivery will be halted. since the example.com domain
is unsigned, anonymous TLS will be used when available, and no
verification will take place.

I'm not sure what you are proposing to change?

Paul