Re: send to ESP with broken STARTTLS

2016-04-02 Thread Dirk Stöcker
On Thu, 31 Mar 2016, A. Schulze wrote: As mentioned we see numerous domains with the same broken MX. I have to list them one by one in the transport table or did I forgot a cool configuration to catch any destination domain with this specific MX? Did you try to contact them to fix their serve

Re: send to ESP with broken STARTTLS

2016-03-31 Thread Viktor Dukhovni
On Thu, Mar 31, 2016 at 10:21:00PM +0200, A. Schulze wrote: > As mentioned we see numerous domains with the same broken MX. > I have to list them one by one in the transport table > or did I forgot a cool configuration to catch any destination domain with > this specific MX? There is no such cool

Re: send to ESP with broken STARTTLS

2016-03-31 Thread A. Schulze
Viktor Dukhovni: iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 Yes, this server has a 768-bit DH key. a larger email service provider :-/ see https://www.robtex.com/en/advisory/ip/94/186/192/102/ The 1024-bit lower limit is enforced internally by the OpenSSL library and cannot b

Re: send to ESP with broken STARTTLS

2016-03-31 Thread Viktor Dukhovni
On Thu, Mar 31, 2016 at 04:47:10PM +0200, A. Schulze wrote: > I hit an MX-Server with weak DH: > > # SLES-Host > # posttls-finger iutax.de > posttls-finger: Connected to > iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 Yes, this server has a 768-bit DH key. > posttls-finger: < 220 gm

send to ESP with broken STARTTLS

2016-03-31 Thread A. Schulze
Hello, I hit an MX-Server with weak DH: # SLES-Host # posttls-finger iutax.de posttls-finger: Connected to iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 posttls-finger: < 220 gmy2-mh901.smtproutes.com kath-5.0.3 ESMTP Ready posttls-finger: > EHLO idvmailout03.datev.de posttls-fing