Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Aug 31, Thomas Orgis [thomas-forum AT orgis.org] wrote:
> Am Tue, 30 Aug 2016 16:26:08 -0500
> schrieb Jeremy Blosser <jblosser-smgl AT firinn.org>: 
> 
> > It doesn't allow SMTP relay, same as before. I can look into allowing
> > SMTP-AUTH using the same certificates, or POP-before-SMTP.
> 
> Well, I didn't need another relay, just wondered about the norm that
> folks at Google, United Internet & Co. would like to have: mails only
> originating from the servers that they belong to … but I'm also not
> enforcing SPF for my server, so if sourcemage.org als doesn't do this,
> in theory @sourcemage mail should still work from that one like it was
> in the old days.

We aren't publishing SPF or DKIM records, you can send from anywhere and
our end won't complain. This does mean gmail doesn't like mail from us,
but that's nothing new. If we wanted to deal with this we'd need to add
some kind of authenticated relay support and then publish those records.

> I must admit that this is the first time that I'm confronted with
> client certs for mail. Have to ponder what's the fun about them (I
> guess none unless you somehow protect the private key).

Since we can't viably forward without trashing our server's reputation,
we have to use a pull method. I chose one that didn't require setting up
some kind of server-side password management and is still more secure
than just a password would have been.