Re: [Uta] MTA-STS with lots of domains

[Daniel Margolis <[e-mail]>]

Yeah, same question as Jim's. If you switched to a common MX, deployment
would be very easy.

To restate your question slightly--because I believe the HTTPS part is in
fact easy (as Andreas noted, it's fairly trivial to automatically serve the
"right" server cert for the desired identity, though I don't claim my
sts-mate is production ready ;) )--your problem is

*Given a large number of domains that share the same physical MTA, but
where each domain has its own in-zone MX record, how do I have the MTA
serve the right certificate, as required by MTA-STS?*

I think this is hard. You probably could get a single cert with SANs for
all of your 80 domains, or one for each new domain, but you will have to
figure out how to automate this (and I guess use SNI to pick the right cert
on the server side--note that the RFC does require SMTP clients to support
SNI, so as to enable this).

As an interesting anecdote, in draft versions of the RFC we specified that
the "mx" patterns in the policy had to match a SAN on the cert, but that
the cert did not in fact have to match the hostname itself, which would
have supported your use case. But we removed it for simplicity.

Since you can achieve the same indirection by sharing an MX host (i.e., a
fixed host, like "mx.provider.com") across all your users, I would
recommend that approach. Is there a specific reason to avoid that, or is
this just the current setup that you have?

On Tue, Jan 8, 2019 at 11:01 PM Jim Fenton <[e-mail]> wrote:

> On 1/8/19 12:59 PM, John R Levine wrote:
> > Adding to the excitement, every domain has its own name for the mail
> > server, e.g., for foo.com the mail server name is mx1.foo.com, all
> > pointing at the same IP address.  (This is not unusual; Tucows
> > hostedemail does the same thing with much longer names.)  So I'll need
> > 80 names on the mail server certificates, too.
>
> You said that you control the DNS for the 80 domains. Is there any
> reason you can't use a common MX name for them?
>
>
> _______________________________________________
> Uta mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/uta
>


-- 
How's my emailing? http://go/dan-email-slo