From f366dc3fd3836d2687e4606cfe7a70c865f64460 Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Thu, 23 May 2024 14:47:50 +0200
Subject: [PATCH] Remove technical subdomains from MTA-STS policies and TLS
 records (closes #429)

---
 crates/common/src/config/smtp/resolver.rs | 12 +++++++-----
 crates/jmap/src/api/management/domain.rs  |  6 +++++-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/crates/common/src/config/smtp/resolver.rs b/crates/common/src/config/smtp/resolver.rs
index c7f6ad5d..51ead82e 100644
--- a/crates/common/src/config/smtp/resolver.rs
+++ b/crates/common/src/config/smtp/resolver.rs
@@ -308,11 +308,13 @@ impl Policy {
 
 impl Core {
     pub fn build_mta_sts_policy(&self) -> Option<Policy> {
-        self.smtp
-            .session
-            .mta_sts_policy
-            .clone()
-            .and_then(|policy| policy.try_build(self.tls.certificates.load().keys()))
+        self.smtp.session.mta_sts_policy.clone().and_then(|policy| {
+            policy.try_build(self.tls.certificates.load().keys().filter(|key| {
+                !key.starts_with("mta-sts.")
+                    && !key.starts_with("autoconfig.")
+                    && !key.starts_with("autodiscover.")
+            }))
+        })
     }
 }
 
diff --git a/crates/jmap/src/api/management/domain.rs b/crates/jmap/src/api/management/domain.rs
index dbd64445..1e6de4c0 100644
--- a/crates/jmap/src/api/management/domain.rs
+++ b/crates/jmap/src/api/management/domain.rs
@@ -297,7 +297,11 @@ impl JMAP {
 
         // Add TLSA records
         for (name, key) in self.core.tls.certificates.load().iter() {
-            if !name.ends_with(domain_name) {
+            if !name.ends_with(domain_name)
+                || name.starts_with("mta-sts.")
+                || name.starts_with("autoconfig.")
+                || name.starts_with("autodiscover.")
+            {
                 continue;
             }