I'm running SendMail 8.14 and have some custom static routes for sending to certain domains. These domains are "internal" but not managed directly by me.
Here's an example of /etc/mail/mailertable
:
fooexample.com esmtp:[1.1.1.1]:[2.2.2.2]
The idea here being that I always want to try sending to 1.1.1.1 first and only send do 2.2.2.2 if the primary is unavailable.
This works great. It even uses opportunistic TLS. Woohoo.
I now want to enforce/require STARTTLS encryption when sending to this domain. That way, if I'm sending to 1.1.1.1 and they somehow don't have TLS, I won't let the message through.
I've implemented this policy for external domains in the past and historically have just added this to /etc/mail/access
:
TLS_Clt:exampledomainname.com ENCR:112
(where examplehostname.com is a part of the MX/A record hostname for a system -- not necessarily the email domain... since email can be handled by cloud services these days).
Annnnnyway, I'm not sure if this will work for my new scenario because I'm using a static route and not resolving MX/A records (which is what I thought TLS_Clt
was ultimately looking at.)
So my questions are:
1) What exactly is TLS_Clt
looking for in the matching pattern and how does it verify this if I'm specifying a static route?
2) Can I simply add TLS_Clt:fooexample.com ENCR:112
? Or should it be something like
TLS_Clt:1.1.1.1 ENCR:112
TLS_Clt:2.2.2.2 ENCR:112
Thanks.