https://blogs.damiendye.uk/en/email/ Recent content in Email on Damien Dye's Blog Hugo en-GB Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Email transport security fails open: a stripped STARTTLS, a stale TLSA record, an unsigned zone or a p=none policy, and mail drops to cleartext or forgeable delivery with nothing telling you. A lab man-in-the-middle, the seven settings and how each fails when wrong, DNSSEC up to DANE, and a census of the banks, providers and CAs. https://blogs.damiendye.uk/en/email/postfix-dane-done-properly/ Thu, 22 Oct 2026 18:50:00 +0100 https://blogs.damiendye.uk/en/email/postfix-dane-done-properly/ A Postfix 3.10 build that refuses plaintext both ways, uses DANE or MTA-STS on every outbound hop, relays only for a login, ties each login to its own address in envelope and From header, drops unknown sender domains, and rejects SPF and DKIM failures in Rspamd. Every reply captured over IPv4 and IPv6, with the traps. https://blogs.damiendye.uk/en/email/microsoft-365-the-fisher-price-it-edition/ Thu, 22 Oct 2026 18:45:00 +0100 https://blogs.damiendye.uk/en/email/microsoft-365-the-fisher-price-it-edition/ The house rules held against Exchange Online, from Microsoft's own docs and read-only DNS. No tenant-wide require-TLS switch, no rejecting an SPF or DKIM failure, DNSSEC not planned for the mail host every tenant uses, and the NCSC's own MX has no IPv6. What it lets you turn on, what it will not, and where its own docs disagree. https://blogs.damiendye.uk/en/email/stalwart-dane-and-the-rest-built-in/ Thu, 22 Oct 2026 18:40:00 +0100 https://blogs.damiendye.uk/en/email/stalwart-dane-and-the-rest-built-in/ Stalwart puts SMTP, IMAP, SPF, DKIM, DMARC, DANE, MTA-STS and a spam filter in one binary, which is the appeal and the catch. The same house rules as the Postfix build, enforced here, with every reply captured in the lab, the permissive defaults it ships with, the four places a rule has to go, and the behaviours that need working around.