MTA-STS and DAME

Hi All,
We test our email using this site: https://www.checktls.com/TestReceiver and shows the result below:

I would like to ask How can I configure MTA-STS and DANE in our ispconfig server? Thank you for your help.

 

here's some instructions for implementing MTA-STS, would need to modify some steps to apply it within ispconfig, and would need to be done manually. it would need code changes to ispconfig to be able to apply it automatically, (eg by a checkbox/form in the ispconfig gui) and would need the dns/mail/website to all be controlled by ispconfig. if any one or more service is not managed by ispconfig then you're always going to have manual steps.

https://www.digitalocean.com/commun...-for-your-domain-using-apache-on-ubuntu-18-04

 

Hi Th0m,
Could you please help me how to generate the DANE record on my certificate? Thank you

 

Hi Th0m,

Thank you I will give it a shot and will let you know

 

Hi Th0m,
I follow your instructions and when I do a DANE checker it shows this:


Any thoughts?

 

Hi Th0m,
My apology for this. I have another inquiry. Where can I find the certificate for incoming mail server? Because when I do a SSL checker for outgoing it shows this:


but for the incoming mail server it shows this:


Thank you for your help

 

Yes, I realize this thread is old, but it's still applicable. I wanted to stress a few things from my experiences using TLSA/DANE.
You really need to tell LetsEncrypt to re-use your private keys for new certificates generation, you do this in certbot using these two:
--keep --reuse-key
or be sure that
reuse_key = True
is in your [renewalparams]. Otherwise you have invalid TLSA records at every little change from LetsEncrypt, which is a PITA.

Furthermore, you could try use https://github.com/tlsaware/danebot if you do DNS locally on your server.
Or try use https://github.com/ekollof/gentlsa if you use CloudFlare for DNS. Problem with this last one is that it fails on python 3.10+.
You can test really well using this mailhardener site, and they also offer openssl commands for generating proper TLSA: https://www.mailhardener.com/kb/how-to-create-a-dane-tlsa-record-with-openssl