> On Sep 7, 2016, at 10:47 AM, Mark Risher <[email protected]> wrote:
>
> It feels like allowing wildcards will help with adoption, because web domains
> [that use them] can then reuse their existing certificates for STARTTLS.
> Deployment and cert reuse are essential to making progress; creating
> key-management challenges for small companies will mean that traffic
> continues in the clear.
>
> I agree that 404 should be a soft fail for the reasons you listed, Dan.
If 404 is a soft fail, and maxage=0 is revocation, what should a sending MTA
do when it encounters a 404 (or indeed an HTTPS connection timeout, handshake
failure, ...)? Retry the HTTPS policy lookup on every delivery? Employ some
sort of hold-down timer between soft-failed lookups? How should the hold-down
be chosen?
My preference is to not have to hammer away at broken or misconfigured the
HTTPS servers with every message delivery, that can have a big effect on SMTP
delivery latency and thereby throughput.
Returning to John Levine's suggestion of SRV records, what should the reference
identifier (and SNI value) be in that case? If it is the SRC record target
host,
should any sub-domain (at any depth) of the nexthop domain be admissible if that
becomes the reference identifier? Or must the target host present a certificate
that exactly matches the original service (nexthop) domain?
I think some language that nails this down is needed in the spec. Please
discuss.
--
Viktor.
_______________________________________________
Uta mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/uta
