Remove technical subdomains from MTA-STS policies and TLS records (closes #429)

2024-05-23 14:47:50 +02:00
parent d52180dcf1
commit f366dc3fd3
2 changed files with 12 additions and 6 deletions
--- a/crates/common/src/config/smtp/resolver.rs
+++ b/crates/common/src/config/smtp/resolver.rs
@@ -308,11 +308,13 @@ impl Policy {

 impl Core {
    pub fn build_mta_sts_policy(&self) -> Option<Policy> {
-        self.smtp
-            .session
-            .mta_sts_policy
-            .clone()
-            .and_then(|policy| policy.try_build(self.tls.certificates.load().keys()))
+        self.smtp.session.mta_sts_policy.clone().and_then(|policy| {
+            policy.try_build(self.tls.certificates.load().keys().filter(|key| {
+                !key.starts_with("mta-sts.")
+                    && !key.starts_with("autoconfig.")
+                    && !key.starts_with("autodiscover.")
+            }))
+        })
    }
 }