[Emailcore] Re: [Last-Call] Re: Re: draft-ietf-emailcore-as-28 ietf last call Secdir review

[Viktor Dukhovni <[e-mail]>]

On Thu, Apr 30, 2026 at 07:51:19AM +0200, Eliot Lear wrote:

> There are times when SMTP servers get misconfigured and simply stop offering
> STARTTLS.  I've had this happen a few times on my server where the private
> and public keys fell out of sync.  Neither sendmail nor postfix are so
> integrated with LE (for example) that things Just Work out of the box.  The
> server falls back to not offering STARTTLS.  What should the client do in
> these circumstances? Produce a 4xx or a 5xx and where is that documented?

When a server does not offer STARTTLS, clients with a typical
opportunistic TLS configuration will send in the clear.

If the server operator has published DANE TLSA records (or the related
poor-man's DANE in the form of MTA-STS, which lacks downgrade-resistant
policy discovery), or the sender requested REQUIRETLS, then the client
might either defer the message if none of the MX hosts are usable
(generally recommended by the Postfix maintainers, the specifications
are mostly silent), or bounce immediately (generally not recommended by
the Postfix maintainers, but REQUIRETLS is an exception).

MTAs acting as SMTP clients of course don't produce 4XX or 5XX result
codes, that's not their role in the protocol, but they can and do
include ehhanced 4.X.Y or 5.X.Y RFC3463 enhanced status codes in any
resulting bounce.

Postfix reports:

    - 4.7.0 when policy lookup fails
    - 4.7.4 when TLS is required by policy, but not offered.
    - 4.7.5 when policy requires TLS, but TLS is not locally
      available.
    - 4.7.5 for failure to establish a TLS connection that meets
      policy requirements.
    - 5.7.10 when REQUIRETLS is requested, but STARTTLS is refused
      by the nexthop MX.
    - 5.7.30 when REQUIRETLS is requested, but not supported by
      any nexthop MX.

Some of these choices are best effort to find closest code point,
others are a good match.

-- 
    Viktor.  🇺🇦 Слава Україні!