how to debug TLS certificate verification error?

2020-02-16 Thread Earl Killian
I am unable to receive mail from my Comcast friends at my Postfix server (postfix-3.2.0-2.6.1 on openSUSE 42.3 with openssl-1.0.2j). As far as I know only Comcast has a problem sending me mail. I have tried asking Comcast for help, but they are useless. I am hoping someone on this list can suggest

Re: how to debug TLS certificate verification error?

2020-02-16 Thread Viktor Dukhovni
On Sun, Feb 16, 2020 at 10:26:45AM -0800, Earl Killian wrote: > I am unable to receive mail from my Comcast friends at my Postfix server > (postfix-3.2.0-2.6.1 on openSUSE 42.3 with openssl-1.0.2j). As far as I > know only Comcast has a problem sending me mail. I have tried asking > Comcast for he

Re: how to debug TLS certificate verification error?

2020-02-16 Thread Bernardo Reino
On Sun, 16 Feb 2020, Viktor Dukhovni wrote: As luck would have it, you've come to the right place. Your domain is DNSSEC-signed, and your MX host has DANE TLSA records: $ hsdig -t a maple.killian.com maple.killian.com. IN A 199.165.155.8 ; NoError AD=1 [...] May I ask you where to fin

Re: how to debug TLS certificate verification error?

2020-02-16 Thread Viktor Dukhovni
> On Feb 16, 2020, at 3:18 PM, Bernardo Reino wrote: > > May I ask you where to find/download your hsdig tool? > > (a quick search indicates that it's some Haskell tool written by yourself, > but I can't seem to find it :) I've not made it available to the public. You can get essentially simi

Re: how to debug TLS certificate verification error?

2020-02-16 Thread Viktor Dukhovni
On Sun, Feb 16, 2020 at 01:41:16PM -0500, Viktor Dukhovni wrote: > ; Suggested more robust TLSA record management approaches can be found > via: > > > https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md > https://mail.sys4.de/pipermail/dan

gmail reverse host issue

2020-02-16 Thread li...@lazygranch.com
Some gmail gets through, some doesn't. Is there a time limit on the DNS check? A google search finds several timers, but nothing specific to DNS. Log: Feb 17 06:18:10 mydomain postfix/smtpd[2619]: connect from unknown[209.85.219.177] Feb 17 06:18:10 mydomain postfix/smtpd[2619]: Anonymous TLS co