HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
Snawoot
postfix-mta-sts-resolver
Python2018–2024
Snawoot / postfix-mta-sts-resolver

postfix-mta-sts-resolver

Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy

3Distinct people
6Mentions
0Explicit recommenders
126GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Daemon which provides TLS client policy for Postfix via socketmap, according to domain MTA-STS policy

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year6 dated mentions

Observed mentions: 2018-09-30 20:34:51 UTC to 2024-10-02 19:02:06 UTC.

0122018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC211
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC202
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101

What Hacker News says

6 sources
Blog author here. There's two parts to get it working on Postfix: To enable MTA-STS for inbound email: Add DNS entries for the MTA-STS record and mta-sts.<domain>. Run a web server that serves the mta-sts.txt file (or use static hosting, like GitHub pages/Netlify/AWS S3/etc). Set up HTTPS on the web server. The repo in the post shows an NGINX approach with Let's Encrypt. To enable MTA-STS for outbound email: you'll need to configure https://github.com/Snawoot/postfix-mta-sts-resolver. Be sure to read through the DANE related challenges in the README as there are some tradeoffs.
In SMTP Downgrade Attacks and MTA-STS
I've been solving similar problem to decouple python daemon logging IO from event loop in order to make logging completely non-blocking. I'm pretty sure this particular case must be most popular file IO case for async applications. In my case it wasn't important to open log asynchronously, but it was critical to have async writes. It turns out, depths of Python stdlib hide logging.handlers.QueueHandler and logging.handlers.QueueListener which allow to split log message handler into separate thread from log message emitters, making them communicate via synchronized queue. Final solution is quite compact: https://github.com/Snawoot/postfix-mta-sts-resolver/blob/589... Usage example: https://github.com/Snawoot/postfix-mta-sts-resolver/blob/589... It is convenient that you can still use logging as usual, without any async obligations. You jus
Read the rest
t have logging function which works in a fire-and-forget fashion. > Asynchronous reads and writes would require all new APIs with different coloring. You’d need an aprint() to complement print(), and so on, each returning an awaitable to be awaited. > This is one of the unfortunate downsides of async/await. I strongly prefer conventional, preemptive concurrency, but we don’t always have that luxury. I was sceptical about Golang for a long time, but recently I've started practicing it. It's designed with concurrency in mind from very beginning and goroutines have advantages of both cooperative and preemptive multitasking. And also it doesn't have GIL, so your goroutines will use all available CPUs without any additional effort from your side. From programmers point of view, coding with goroutines looks exactly like coding with use of pthreads (even simpler, in fact). So, there are no function "coloring", no need in sync/async library flavors and so on. But these "threads" also have cost close to cost of python coroutines. It sounds too good to be true, but I've rewritten bunch of my Python/asyncio code in Go and I can say it's true. For this reason (and many others I discovered later) I quit using Python and asyncio for network applications in favor of Go.
In Asynchronously Opening and Closing Files in Asyncio
It's worth noting that blog post covers only one-way MTA-STS, announcing STS policy to other SMTP peers, protecting only inbound mail from MTA-STS enabled servers. In order to ensure strict transport security on sender side (for mail outbound from server), one have add support for MTA-STS to mail server itself. I'm developer of such solution for Postfix mail server: https://github.com/Snawoot/postfix-mta-sts-resolver It's an external policy server for Postfix which retrieves, validates, caches and prefetches STS policies for target mail domains. postfix-mta-sts-resolver package is already available in Debian repos and I guess it'll be included in upcoming Ubuntu 20.04 LTS. If I recall correctly there are also FreeBSD port, docker images and AUR package for Arch Linux.
In Enable MTA-STS in 5 Minutes with Nginx
I deployed this a few days ago using postfix-mta-sts-resolver in docker, spun up an nginx server to handle the txt file, and added the dns txt record. Fairly straightforward. I'll keep an eye on my logs and see if it changes anything. I also note that google is in the starttls-policy [1] list in testing mode (they're also on testing, not enforced, for mta-sts on gmail.com [2]) [0] https://github.com/Snawoot/postfix-mta-sts-resolver (this is more up-to-date than the PyPI package) [1] https://starttls-everywhere.org/policy-list/ [2] https://mta-sts.gmail.com/.well-known/mta-sts.txt
In Making email more secure with MTA-STS standard
At this moment there are no MTA-STS support in postfix. But this thread [1] in postfix-users mailing list suggests acceptable solution: use external policy server for MTA-STS discovery. I have implemented such server: package on PyPI [2], source on Github [3]. Works for me. [1] http://postfix.1071664.n5.nabble.com/MTA-STS-when-td95086.ht... [2] https://pypi.org/project/postfix-mta-sts-resolver/ [3] https://github.com/Snawoot/postfix-mta-sts-resolver
In SMTP MTA Strict Transport Security (MTA-STS)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.