Re: [Uta] Smallest practical MTA-STS maximum policy age?

Gmail's max_age is (as you can see) 1 day (
https://mta-sts.gmail.com/.well-known/mta-sts.txt). (Looking at other big
mail providers, Comcast is at 30d, Outlook at 7d, mail.de at 28d, and Yahoo
at 1d--so I feel like we could raise Gmail's!)

It would be reasonable for an MTA to ignore a policy that had a timeout of,
like, 1 second, since for many lower-volume senders policy refreshes might
thus constitute a meaningful increase in traffic. So don't do that. ;)

On Sun, May 24, 2020 at 6:19 PM John Levine <johnl@taugh.com> wrote:

> In article <
> CANHgQ8H0dnNQCzrP0rXxZhLh+D52vsqiRyOk8pu9fFifZwBWTw@mail.gmail.com> you
> write:
> >> Thus, my take is that MTA-STS policies with a max_age less than ~30 days
> >> are potentially ineffective, and perhaps not worth the bother.
> >
> >Sure, for production use.
> >
> >The issue I am seeing is this: New users are experimenting with MTA-STS
> and
> >wish to use a small policy duration until they're confident in their
> >configuration. They use values in hours and don't get any reports.
> >
> >Perhaps there's a case for specifying a minimum acceptable policy duration
> >in RFC errata or something?
>
> I publish 86400 max_age and get lots of reports, mostly from Google
> and Comcast. If they're testing they should be using testing mode,
> and the age doesn't matter so much.
>
> version: STSv1
> mode: testing
> mx: <whatever>
> max_age: 86400
>
> My setup is a little odd because my mail servers have a different name
> for each domain pointed at them so I'm also testing whether clients
> provide SNI to ask for the right certificate and my servers correctly
> provide it. As far as I can tell they all do. It's not a perfect test
> because all of the certs for each server have the same key and so the
> same TLSA which (I think, Viktor?) would work even if it provided the
> wrong certificate.
>
>
>
> _______________________________________________
> Uta mailing list
> Uta@ietf.org
> https://www.ietf.org/mailman/listinfo/uta
>

-- 
How's my emailing? http://go/dan-email-slo

Re: [Uta] Smallest practical MTA-STS maximum policy age?

Attachment: smime.p7s