On Thu, Jun 25, 2026 at 07:29:55PM +0000, Andy Smith via mailop wrote:
> I had an annoying issue this week where email to a customer was
> failing to be sent due to GnuTLS on our side (in Exim) not liking
> their DANE setup. I can't give real-world details but the Exim error
> was:
>
> 2026-06-21 01:45:14 1wb7FD-0002TW-C9 == [email protected] R=dnslookup
> T=remote_smtp defer (-37) H=their-mx.example.org [192.168.4.2]: TLS
> session: (certificate verification failed): Verification failed. CA
> constrains were violated
>
> As no email reached them I just thought they weren't responding, then I
> wondered if our mail was going to their spam folder or whatever, before
> finally our outbound relays told me of the mails that had not yet been
> delivered after a couple of days, at which point I thought to actually
> examine our logs.
>
> I should have looked sooner but these days I'm so used to it being a
> problem on the customer end after delivery.
> Anyway, it turns out that the problem was they didn't have a TLSA record
> in DNS for example.com.
Surely, they rather had an incorrect TLSA RRset, that did not match
their actual certificates. If no TLSA records were present, Exim
would not have attempted DANE.
> To work around this and be able to send them email, I had to add:
>
> hosts_try_dane = ! their-mx.example.org
That's one workaround.
> I wonder about how to test a DANE setup for correctness, from the
> command line, though. I'm not familiar with how to set up DANE so I
> should look into that and "retrace the steps" of what Exim is doing,
> using tools like dig and openssl, I suppose. But I was wondering uf any
> of you have had to do similar in the past and have a go-to method?
https://list.sys4.de/hyperkitty/list/[email protected]/message/6723WDBLPYWSXAORTAJR7EPAIOFAP5N4/
https://github.com/vdukhovni/danecheck
https://list.sys4.de/hyperkitty/list/[email protected]/thread/CSSH3W6ZBXXGXCLJVV4DCITOQQ2WSVFK/
> Ultimately if I come up with something I will be putting it into
> monitoring so that our customer can say, "I set up DANE for mail to
> some.example.com" and we can say "our monitoring thinks this is done
> correctly (or not)".
>
> Sadly I no longer have a real-world example of this failure mode as they
> have fixed it! 😀 Guess I can try to make one…
There are many more, one persistent example is "argeweb.com":
https://stats.dnssec-tools.org/explore/?argeweb.com
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
