Hi, I had an annoying issue this week where email to a customer was failing to be sent due to GnuTLS on our side (in Exim) not liking their DANE setup. I can't give real-world details but the Exim error was:
2026-06-21 01:45:14 1wb7FD-0002TW-C9 == [email protected] R=dnslookup T=remote_smtp defer (-37) H=their-mx.example.org [192.168.4.2]: TLS session: (certificate verification failed): Verification failed. CA constrains were violated As no email reached them I just thought they weren't responding, then I wondered if our mail was going to their spam folder or whatever, before finally our outbound relays told me of the amils that had not yet been delivered after a couple of days, at which point I thought to actually examine our logs. I should have looked sooner but these days I'm so used to it being a problem on the customer end after delivery. Anyway, it turns out that the problem was they didn't have a TLSA record in DNS for example.com. To work around this and be able to send them email, I had to add: hosts_try_dane = ! their-mx.example.org to our remote_smtp transport in Exim until they fixed it. (longer term I do have a note to get such a list from a config file so we don't have to edit the actual transport configuration each time we come across this sort of thing.) I wonder about how to test a DANE setup for correctness, from the command line, though. I'm not familiar with how to set up DANE so I should look into that and "retrace the steps" of what Exim is doing, using tools like dig and openssl, I suppose. But I was wondering uf any of you have had to do similar in the past and have a go-to method? Ultimately if I come up with something I will be putting it into monitoring so that our customer can say, "I set up DANE for mail to some.example.com" and we can say "our monitoring thinks this is done correctly (or not)". Sadly I no longer have a real-world example of this failure mode as they have fixed it! 😀 Guess I can try to make one… Thanks, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
