Mario Fetka
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# TLS policy
|
|
|
|
Bongo offers TLS 1.3 and TLS 1.2 by default. Older protocol versions are only
|
|
available on listeners whose explicit legacy-TLS option is enabled. Keep those
|
|
listeners restricted to trusted legacy networks; do not expose them directly
|
|
to the Internet.
|
|
|
|
The SMTP delivery agent uses opportunistic STARTTLS. When a peer offers
|
|
STARTTLS, `outbound_tls_verify` verifies its certificate chain against the
|
|
system trust store and verifies the connected MX or configured LMTP host name.
|
|
It defaults to `true`. Set it to `false` only for a peer whose certificate
|
|
cannot yet be repaired.
|
|
|
|
`outbound_tls_required` defaults to `false`, so delivery remains possible to
|
|
SMTP servers which do not offer STARTTLS. Enabling it defers mail instead of
|
|
sending plaintext. It is a global policy and should only be enabled when every
|
|
configured destination is known to support TLS. A later policy layer may apply
|
|
per-domain DANE or MTA-STS requirements.
|
|
|
|
External-account collection and submission use libcurl and independently
|
|
verify certificates and host names by default. See `external-accounts.md` for
|
|
the credential and provider policy.
|