[Emailcore] Re: [Last-Call] Re: Re: Re: Re: Re: Re: Re: draft-ietf-emailcore-as-28 ietf last call Secdir review

[Viktor Dukhovni <[e-mail]>]

On Thu, May 07, 2026 at 12:25:58PM -0400, Michael Richardson wrote:

> What I want/need and I suspect others do as well, is some facilities in MTA software:
>
> 1. ability to demand (or allow bypass) of STARTTLS on a per-IP address basis.
>    The bypass specifically allows an operator to accept email from legacy
>    devices.   Like the full-size multifunction scanner I had in my previous
>    office that would email the scanned documents as PDFs.

Postfix can do this out of the box.

  - Selectively strip STARTTLS:
    https://www.postfix.org/posconf.5.html#smtpd_discard_ehlo_keyword_address_maps

  - Selectively require or tolerate lack of STARTTLS:
    https://www.postfix.org/postconf.5.html#plaintext_reject_code
    https://www.postfix.org/postconf.5.html#smtpd_sender_restrictions

        smtpd_sender_restrictions =
            check_client_access cidr:{
                # Selective require
                {192.0.2.0/24  reject_plaintext_session}
                }

    OR

        smtpd_sender_restrictions =
            check_client_access cidr:{
                # Selective tolerance
                {192.0.2.0/24  DUNNO}
                {0.0.0.0/0  reject_plaintext_session}
                }

> 2. ability to demand that some mailboxes only get STARTTLS, and if the sender
>    didn't do that, then the mailbox probably does not exist.  Or..more variations.

Ditto, with per recipient rules.

> 3. potentially the same things again with per client-certificate
>    sub-policies.  client-certificate based policies potentially get around
>    the NAT44 filtering problem, but obviously, require STARTTLS.

Catch-22 if you mean tolerating lack of TLS.  If you mean
something else, probably out of scope here.

> {Much of what I describe above is already possible in some systems, but the
> ways in which it can be combined, explained, is very uneven.  So it's harder
> for customer/operators to communicate this well to suppliers}

The A/S can't mandate a uniform configuration **interface**, and we
wouldn't want it to.

-- 
    Viktor.  🇺🇦 Слава Україні!