{"id":91951,"date":"2020-08-20T19:42:11","date_gmt":"2020-08-20T17:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts"},"modified":"2020-08-20T19:42:11","modified_gmt":"2020-08-20T17:42:11","slug":"pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","title":{"rendered":"Mail.ru za\u010d\u00edn\u00e1 v testovac\u00edm re\u017eimu aplikovat politiky MTA-STS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mail.ru za\u010d\u00edn\u00e1 v testovac\u00edm re\u017eimu aplikovat politiky MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/1f0b7542aedb372c06c2077ea987dd36.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud to shrneme, MTA-STS je zp\u016fsob, jak d\u00e1le chr\u00e1nit e-maily p\u0159ed zachycen\u00edm (tj. \u00fatoky typu mu\u017e uprost\u0159ed, aka MitM) p\u0159i p\u0159enosu mezi po\u0161tovn\u00edmi servery. \u010c\u00e1ste\u010dn\u011b \u0159e\u0161\u00ed zd\u011bd\u011bn\u00e9 architektonick\u00e9 probl\u00e9my e-mailov\u00fdch protokol\u016f a je pops\u00e1n v relativn\u011b nov\u00e9m standardu RFC 8461. Mail.ru je prvn\u00ed velk\u00e1 po\u0161tovn\u00ed slu\u017eba v Rusk\u00e9m internetu, kter\u00e1 implementovala tento standard. Podrobn\u011bji se o tom hovo\u0159\u00ed n\u00ed\u017ee.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Jak\u00fd probl\u00e9m MTA-STS \u0159e\u0161\u00ed?<\/h1>\n<p>\nHistoricky e-mailov\u00e9 protokoly (SMTP, POP3, IMAP) p\u0159en\u00e1\u0161ely informace v nezabezpe\u010den\u00e9 podob\u011b, co\u017e umo\u017e\u0148uje jejich zachycen\u00ed, nap\u0159\u00edklad p\u0159i p\u0159\u00edstupu k komunika\u010dn\u00edmu kan\u00e1lu.<\/p>\n<p>Jak vypad\u00e1 mechanismus doru\u010den\u00ed e-mailu od jednoho u\u017eivatele k druh\u00e9mu:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru za\u010d\u00edn\u00e1 v testovac\u00edm re\u017eimu aplikovat politiky MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/5b0d4749298d7644220a6322912d8716.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHistoricky bylo mo\u017en\u00e9 \u00fatoky MitM prov\u00e1d\u011bt na v\u0161ech m\u00edstech, kde proch\u00e1z\u00ed e-mail.<\/p>\n<p>Standard RFC 8314 vy\u017eaduje povinn\u00e9 pou\u017e\u00edv\u00e1n\u00ed TLS mezi po\u0161tovn\u00edm klientem u\u017eivatele (MUA) a po\u0161tovn\u00edm serverem. Pokud v\u00e1\u0161 server a pou\u017e\u00edvan\u00e9 po\u0161tovn\u00ed aplikace spl\u0148uj\u00ed RFC 8314, pak jste (do zna\u010dn\u00e9 m\u00edry) eliminovali mo\u017enost \u00fatok\u016f typu mu\u017e uprost\u0159ed mezi u\u017eivateli a po\u0161tovn\u00edmi servery.<\/p>\n<p>Dodr\u017eov\u00e1n\u00ed b\u011b\u017en\u011b uzn\u00e1van\u00fdch praktik (standardizovan\u00fdch RFC 8314) eliminuje \u00fatoky v bl\u00edzkosti u\u017eivatele:<\/p>\n<p><img decoding=\"async\" alt=\"Mail.ru za\u010d\u00edn\u00e1 v testovac\u00edm re\u017eimu aplikovat politiky MTA-STS\" src=\"\/wp-content\/uploads\/2020\/08\/7a45c95793ec958c46f63898db39c1fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo\u0161tovn\u00ed servery Mail.ru splnily RFC 8314 ji\u017e p\u0159ed jeho p\u0159ijet\u00edm, ve skute\u010dnosti pouze zaznamen\u00e1v\u00e1 ji\u017e p\u0159ijat\u00e9 praktiky a nemuseli jsme nic nastavovat nav\u00edc. Pokud v\u0161ak v\u00e1\u0161 po\u0161tovn\u00ed server st\u00e1le povoluje u\u017eivatel\u016fm pou\u017e\u00edv\u00e1n\u00ed nezabezpe\u010den\u00fdch protokol\u016f, ur\u010dit\u011b implementujte doporu\u010den\u00ed tohoto standardu, proto\u017ee pravd\u011bpodobn\u011b alespo\u0148 \u010d\u00e1st va\u0161ich u\u017eivatel\u016f pracuje s e-mailem bez \u0161ifrov\u00e1n\u00ed, i kdy\u017e jej podporujete.<\/p>\n<p>Po\u0161tovn\u00ed klient v\u017edy pracuje s jedn\u00edm a t\u00edm sam\u00fdm po\u0161tovn\u00edm serverem jedn\u00e9 a t\u00e9\u017ee organizace. A lze donutit v\u0161echny u\u017eivatele, aby se p\u0159ipojovali bezpe\u010dn\u00fdm zp\u016fsobem, p\u0159i\u010dem\u017e se pak stane technicky nemo\u017en\u00fdm p\u0159ipojit se nezabezpe\u010den\u00fdm zp\u016fsobem (to je p\u0159esn\u011b to, co po\u017eaduje RFC 8314). N\u011bkdy je to obt\u00ed\u017en\u00e9, ale realizovateln\u00e9. S provozem mezi po\u0161tovn\u00edmi servery je to je\u0161t\u011b slo\u017eit\u011bj\u0161\u00ed. Servery pat\u0159\u00ed r\u016fzn\u00fdm organizac\u00edm a \u010dasto se pou\u017e\u00edvaj\u00ed v re\u017eimu \u201enainstaluj a zapome\u0148\u201c, co\u017e znemo\u017e\u0148uje jednor\u00e1zov\u00e9 p\u0159epnut\u00ed na bezpe\u010dn\u00fd protokol bez naru\u0161en\u00ed spojen\u00ed. V protokolu SMTP je ji\u017e del\u0161\u00ed dobu k dispozici roz\u0161\u00ed\u0159en\u00ed STARTTLS, kter\u00e9 umo\u017e\u0148uje server\u016fm podporuj\u00edc\u00edm \u0161ifrov\u00e1n\u00ed p\u0159epnout na TLS. Ale \u00fato\u010dn\u00edk, kter\u00fd m\u00e1 mo\u017enost ovlivnit provoz, m\u016f\u017ee \u201evykrojit\u201c informace o podpo\u0159e tohoto p\u0159\u00edkazu a p\u0159inutit servery, aby komunikovaly prost\u0159ednictv\u00edm b\u011b\u017en\u00e9ho textov\u00e9ho protokolu (tzv. downgrade attack \u2013 \u00fatok na sn\u00ed\u017een\u00ed verze protokolu). Z toho d\u016fvodu se pro STARTTLS obvykle neov\u011b\u0159uje shoda certifik\u00e1tu (ned\u016fv\u011bryhodn\u00fd certifik\u00e1t m\u016f\u017ee chr\u00e1nit p\u0159ed pasivn\u00edmi \u00fatoky a je to lep\u0161\u00ed ne\u017e odes\u00edl\u00e1n\u00ed zpr\u00e1vy v otev\u0159en\u00e9m textu). Proto STARTTLS chr\u00e1n\u00ed pouze p\u0159ed pasivn\u00edm odposlouch\u00e1v\u00e1n\u00edm.<\/p>\n<p>MTA-STS \u010d\u00e1ste\u010dn\u011b \u0159e\u0161\u00ed probl\u00e9m odposlechu zpr\u00e1v mezi po\u0161tovn\u00edmi servery, kdy\u017e m\u00e1 \u00fato\u010dn\u00edk mo\u017enost aktivn\u011b ovlivnit provoz. Pokud dom\u00e9na p\u0159\u00edjemce publikuje politiku MTA-STS a server odes\u00edlatele podporuje MTA-STS, bude zpr\u00e1va odesl\u00e1na pouze prost\u0159ednictv\u00edm TLS p\u0159ipojen\u00ed, pouze na servery ur\u010den\u00e9 politikou a pouze s ov\u011b\u0159en\u00edm certifik\u00e1tu serveru.<\/p>\n<p>Pro\u010d \u010d\u00e1ste\u010dn\u011b? MTA-STS funguje pouze tehdy, kdy\u017e ob\u011b strany dbaj\u00ed na implementaci tohoto standardu, a MTA-STS nechr\u00e1n\u00ed p\u0159ed sc\u00e9n\u00e1\u0159i, ve kter\u00fdch m\u00e1 \u00fato\u010dn\u00edk mo\u017enost z\u00edskat platn\u00fd certifik\u00e1t dom\u00e9ny v jednom z ve\u0159ejn\u00fdch CA.<\/p>\n<h1>Jak funguje MTA-STS<\/h1>\n<p>\n<b>P\u0159\u00edjemce<\/b><\/p>\n<ol>\n<li>Nastavuje podporu STARTTLS s platn\u00fdm certifik\u00e1tem na po\u0161tovn\u00edm serveru.\u00a0<\/li>\n<li>Publikuje prost\u0159ednictv\u00edm HTTPS politiku MTA-STS, pro publikaci se pou\u017e\u00edv\u00e1 speci\u00e1ln\u00ed dom\u00e9na mta-sts a speci\u00e1ln\u00ed well-known cesta, nap\u0159\u00edklad <code>https:\/\/mta-sts.mail.ru\/.well-known\/mta-sts.txt<\/code>. Politika obsahuje seznam po\u0161tovn\u00edch server\u016f (mx), kter\u00e9 maj\u00ed pr\u00e1vo p\u0159ij\u00edmat po\u0161tu pro tuto dom\u00e9nu.<\/li>\n<li>Publikuje speci\u00e1ln\u00ed TXT z\u00e1znam _mta-sts v DNS s verz\u00ed politiky. P\u0159i zm\u011bn\u011b politiky by tento z\u00e1znam m\u011bl b\u00fdt aktualizov\u00e1n (co\u017e signalizuje odes\u00edlateli, \u017ee je t\u0159eba znovu po\u017e\u00e1dat o politiku). Nap\u0159\u00edklad, <code>_mta-sts.mail.ru. TXT \"v=STSv1; id=20200303T120000;\"<\/code><\/li>\n<\/ol>\n<p>\n<b>Odes\u00edlatel<\/b><\/p>\n<p>Odes\u00edlatel po\u017eaduje DNS z\u00e1znam _mta-sts, a pokud existuje, prov\u00e1d\u00ed dotaz na politiku p\u0159es HTTPS (ov\u011b\u0159uje certifik\u00e1t). Z\u00edskan\u00e1 politika se uchov\u00e1v\u00e1 v cache (pro p\u0159\u00edpad, \u017ee \u00fato\u010dn\u00edk zablokuje p\u0159\u00edstup k n\u00ed nebo podvrhne DNS z\u00e1znam).<\/p>\n<p>P\u0159i odes\u00edl\u00e1n\u00ed emailu se kontroluje, \u017ee:<\/p>\n<ul>\n<li>server, na kter\u00fd je email doru\u010dov\u00e1n, je v politice;<\/li>\n<li>server p\u0159ij\u00edm\u00e1 email s pou\u017eit\u00edm TLS (STARTTLS) a m\u00e1 platn\u00fd certifik\u00e1t.<\/li>\n<\/ul>\n<p><\/p>\n<h1>V\u00fdhody MTA-STS<\/h1>\n<p>\nMTA-STS vyu\u017e\u00edv\u00e1 technologie, kter\u00e9 jsou ji\u017e implementov\u00e1ny ve v\u011bt\u0161in\u011b organizac\u00ed (SMTP+STARTTLS, HTTPS, DNS). Pro implementaci na stran\u011b p\u0159\u00edjemce nen\u00ed vy\u017eadov\u00e1na speci\u00e1ln\u00ed softwarov\u00e1 podpora standardu.<\/p>\n<h1>Nev\u00fdhody MTA-STS<\/h1>\n<p>\nJe t\u0159eba db\u00e1t na platnost certifik\u00e1tu webov\u00e9ho a po\u0161tovn\u00edho serveru, souladu n\u00e1zv\u016f a v\u010dasnou aktualizaci. Probl\u00e9my s certifik\u00e1tem povedou k neschopnosti doru\u010dit email.<\/p>\n<p>Na stran\u011b odes\u00edlatele je vy\u017eadov\u00e1no MTA s podporou politik MTA-STS, v sou\u010dasn\u00e9 dob\u011b MTA-STS nen\u00ed nativn\u011b podporov\u00e1no v MTA.<\/p>\n<p>MTA-STS vyu\u017e\u00edv\u00e1 seznam d\u016fv\u011bryhodn\u00fdch ko\u0159enov\u00fdch CA.<\/p>\n<p>MTA-STS nechr\u00e1n\u00ed p\u0159ed \u00fatoky, p\u0159i kter\u00fdch \u00fato\u010dn\u00edk pou\u017e\u00edv\u00e1 platn\u00fd certifik\u00e1t. Ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f MitM bl\u00edzko serveru znamen\u00e1 mo\u017enost vyd\u00e1n\u00ed certifik\u00e1tu. Takov\u00fd \u00fatok m\u016f\u017ee b\u00fdt odhalen d\u00edky Certificate Transparency. Proto celkov\u011b MTA-STS zm\u00edr\u0148uje, ale neodstra\u0148uje \u00fapln\u011b mo\u017enost odposlechu provozu.<\/p>\n<p>Dva posledn\u00ed body \u010din\u00ed MTA-STS m\u00e9n\u011b chr\u00e1n\u011bn\u00fdm ne\u017e konkuren\u010dn\u00ed standard DANE pro SMTP (RFC 7672), ale technicky spolehliv\u011bj\u0161\u00edm, t.j. pro MTA-STS je n\u00edzk\u00e1 pravd\u011bpodobnost, \u017ee email nebude doru\u010den kv\u016fli technick\u00fdm probl\u00e9m\u016fm zp\u016fsoben\u00fdm implementac\u00ed standardu.<\/p>\n<h4>Konkuren\u010dn\u00ed standard \u2014 DANE<\/h4>\n<p>\nDANE pou\u017e\u00edv\u00e1 DNSSEC k publikaci informac\u00ed o certifik\u00e1tech a nevy\u017eaduje d\u016fv\u011bru v extern\u00ed certifika\u010dn\u00ed autority, co\u017e je mnohem bezpe\u010dn\u011bj\u0161\u00ed. Nicm\u00e9n\u011b pou\u017e\u00edv\u00e1n\u00ed DNSSEC \u010dasto vede k technick\u00fdm probl\u00e9m\u016fm, pokud se spol\u00e9h\u00e1me na statistiky za n\u011bkolik let pou\u017e\u00edv\u00e1n\u00ed (p\u0159esto\u017ee v oblasti spolehlivosti DNSSEC a jeho technick\u00e9 podpory celkov\u011b pozorujeme pozitivn\u00ed trend). Pro implementaci DANE v SMTP na stran\u011b p\u0159\u00edjemce je nutn\u00e9 m\u00edt DNSSEC pro DNS z\u00f3nu, p\u0159i\u010dem\u017e pro DANE je kl\u00ed\u010dov\u00e1 spr\u00e1vn\u00e1 podpora NSEC\/NSEC3, s n\u00ed\u017e m\u00e1 DNSSEC syst\u00e9mov\u00e9 probl\u00e9my.<\/p>\n<p>Pokud je DNSSEC nakonfigurov\u00e1no chybn\u011b, m\u016f\u017ee to v\u00e9st k odm\u00edtnut\u00ed dod\u00e1n\u00ed e-mail\u016f, pokud odes\u00edlaj\u00edc\u00ed strana podporuje DANE, i kdy\u017e p\u0159\u00edjemce o n\u011bm nic nev\u00ed. Proto, i kdy\u017e je DANE star\u0161\u00ed a bezpe\u010dn\u011bj\u0161\u00ed standard ji\u017e podporovan\u00fd v n\u011bkter\u00e9m serverov\u00e9m softwaru na stran\u011b odes\u00edlatele, jeho nasazen\u00ed z\u016fst\u00e1v\u00e1 zat\u00edm nev\u00fdznamn\u00e9. Mnoho organizac\u00ed nen\u00ed p\u0159ipraveno ho zav\u00e1d\u011bt kv\u016fli nutnosti implementace DNSSEC, co\u017e zna\u010dn\u011b brzdilo p\u0159ijet\u00ed DANE po celou dobu existence standardu.<\/p>\n<p>DANE a MTA-STS si navz\u00e1jem neodporuj\u00ed a mohou b\u00fdt pou\u017e\u00edv\u00e1ny spole\u010dn\u011b.<\/p>\n<h1>Jak je to s podporou MTA-STS v Mail.ru?<\/h1>\n<p>\nMail.ru ji\u017e dost dlouho publikuje politiku MTA-STS pro v\u0161echny hlavn\u00ed dom\u00e9ny. Nyn\u00ed se zab\u00fdv\u00e1me implementac\u00ed klientsk\u00e9 \u010d\u00e1sti standardu. V dob\u011b psan\u00ed tohoto \u010dl\u00e1nku jsou politiky uplat\u0148ov\u00e1ny v neblokuj\u00edc\u00edm re\u017eimu (pokud je doru\u010den\u00ed blokov\u00e1no politikou, e-mail bude dod\u00e1n prost\u0159ednictv\u00edm \"n\u00e1hradn\u00edho\" serveru bez pou\u017eit\u00ed politik), pot\u00e9 bude vynucen blokuj\u00edc\u00ed re\u017eim pro malou \u010d\u00e1st odchoz\u00edho SMTP provozu, kter\u00fd postupn\u011b podpo\u0159\u00ed pou\u017eit\u00ed politik pro 100% provozu.<\/p>\n<h1>Kdo dal\u0161\u00ed podporuje standard?<\/h1>\n<p>\nV sou\u010dasnosti publikuje politiky MTA-STS p\u0159ibli\u017en\u011b 0,05 % aktivn\u00edch dom\u00e9n, p\u0159esto v\u0161ak u\u017e chr\u00e1n\u00ed velk\u00e9 objemy e-mailov\u00e9ho provozu, proto\u017ee standard podporuj\u00ed velc\u00ed hr\u00e1\u010di \u2014 Google, Comcast a \u010d\u00e1ste\u010dn\u011b Verizon (AOL, Yahoo). Mnoho dal\u0161\u00edch e-mailov\u00fdch slu\u017eeb ozn\u00e1milo, \u017ee podpora standardu bude realizov\u00e1na v bl\u00edzk\u00e9 budoucnosti.<\/p>\n<h1>Jak se to dotkne m\u011b?<\/h1>\n<p>\nNicoliv, pokud v\u00e1\u0161 dom\u00e9nov\u00fd server nepublikuje politiku MTA-STS. Pokud politiku publikujete, budou e-maily pro u\u017eivatele va\u0161eho po\u0161tovn\u00edho serveru l\u00e9pe chr\u00e1n\u011bny p\u0159ed odposlechem.<\/p>\n<h1>Jak implementovat MTA-STS?<\/h1>\n<p>\n<b>Podpora MTA-STS na stran\u011b p\u0159\u00edjemce<\/b><\/p>\n<p>Sta\u010d\u00ed publikovat politiku prost\u0159ednictv\u00edm HTTPS a z\u00e1znam\u016f v DNS, nastavit platn\u00fd certifik\u00e1t od jednoho z d\u016fv\u011bryhodn\u00fdch CA (m\u016f\u017eete pou\u017e\u00edt Let\u2019s Encrypt) pro STARTTLS v MTA (STARTTLS podporuj\u00ed v\u0161echny modern\u00ed MTA), speci\u00e1ln\u00ed podpora ze strany MTA nen\u00ed pot\u0159ebn\u00e1.<\/p>\n<p>Po kroc\u00edch to vypad\u00e1 takto:<\/p>\n<ol>\n<li>Nastavte STARTTLS ve va\u0161em pou\u017e\u00edvan\u00e9m MTA (postfix, exim, sendmail, Microsoft Exchange atd.).<\/li>\n<li>Ujist\u011bte se, \u017ee je pou\u017eit platn\u00fd certifik\u00e1t (vydan\u00fd d\u016fv\u011bryhodn\u00fdm CA, nepro\u0161l\u00fd, subjekt certifik\u00e1tu odpov\u00edd\u00e1 MX z\u00e1znamu, podle kter\u00e9ho je doru\u010dov\u00e1na po\u0161ta pro va\u0161i dom\u00e9nu).<\/li>\n<li>Nastavte z\u00e1znam TLS-RPT, na kter\u00fd budou zas\u00edl\u00e1ny zpr\u00e1vy o pou\u017eit\u00ed politiky (slu\u017ebami podporuj\u00edc\u00edmi zas\u00edl\u00e1n\u00ed zpr\u00e1v TLS). P\u0159\u00edklad z\u00e1znamu (pro dom\u00e9nu example.com):\n<pre><code class=\"plaintext\">smtp._tls.example.com. 300 IN TXT \"v=TLSRPTv1;rua=mailto:tlsrpt@example.com\"<\/code><\/pre>\n<p>\nTento z\u00e1znam instruuje odes\u00edlatele e-mail\u016f, aby zas\u00edlali statistick\u00e9 zpr\u00e1vy o pou\u017eit\u00ed TLS v SMTP na adresu <code>tlsrpt@exmple.com<\/code>.<\/p>\n<p>Sledujte zpr\u00e1vy n\u011bkolik dn\u00ed, ujist\u011bte se, \u017ee nejsou \u017e\u00e1dn\u00e9 chyby.<\/li>\n<li>Publikujte politiku MTA-STS prost\u0159ednictv\u00edm HTTPS. Politika se publikuje jako textov\u00fd soubor s ukon\u010duj\u00edc\u00edmi znaky CRLF na um\u00edst\u011bn\u00ed.\n<pre><code class=\"plaintext\">https:\/\/mta-sts.example.com\/.well-known\/mta-sts.txt\n<\/code><\/pre>\n<p>\nP\u0159\u00edklad politiky:<\/p>\n<pre><code class=\"plaintext\">version: STSv1\nmode: enforce\nmx: mxs.mail.ru\nmx: emx.mail.ru\nmx: mx2.corp.mail.ru\nmax_age: 86400\n<\/code><\/pre>\n<p>\nPole version obsahuje verzi politiky (nyn\u00ed je to <code>STSv1<\/code>), Mode ur\u010duje re\u017eim pou\u017eit\u00ed politiky, testing \u2014 testovac\u00ed re\u017eim (politika se neuplat\u0148uje), enforce \u2014 \"produk\u010dn\u00ed\" re\u017eim. Nejprve publikujte politiku s mode: testing, pokud s politikou nebudou probl\u00e9my v testovac\u00edm re\u017eimu, po ur\u010dit\u00e9m \u010dase se m\u016f\u017eete p\u0159epnout na mode: enforce.<\/p>\n<p>V mx je uveden seznam v\u0161ech po\u0161tovn\u00edch server\u016f, kter\u00e9 mohou p\u0159ij\u00edmat po\u0161tu pro va\u0161i dom\u00e9nu (u ka\u017ed\u00e9ho serveru mus\u00ed b\u00fdt nastaven certifik\u00e1t odpov\u00eddaj\u00edc\u00ed n\u00e1zvu uveden\u00e9mu v mx). Max_age ur\u010duje dobu ke\u0161ov\u00e1n\u00ed politiky (jednou zapamatovan\u00e1 politika bude aplikov\u00e1na, i kdy\u017e \u00fato\u010dn\u00edk zablokuje jej\u00ed vyd\u00e1n\u00ed nebo po\u0161kod\u00ed DNS z\u00e1znamy b\u011bhem doby ke\u0161ov\u00e1n\u00ed, sign\u00e1l k op\u011btovn\u00e9mu dotazu na politiku lze zaslat zm\u011bnou mta-sts z\u00e1znamu v DNS).<\/li>\n<li>Publikujte v DNS TXT z\u00e1znam:\u00a0\n<pre><code class=\"plaintext\">_mta-sts.example.com. TXT \"v=STS1; id=someid;\"\n<\/code><\/pre>\n<p>\nV poli id lze pou\u017e\u00edt libovoln\u00fd identifik\u00e1tor (nap\u0159\u00edklad \u010dasovou zna\u010dku), p\u0159i zm\u011bn\u011b politiky by se m\u011bl m\u011bnit, co\u017e umo\u017e\u0148uje odes\u00edlatel\u016fm pochopit, \u017ee je t\u0159eba znovu na\u010d\u00edst mezipam\u011b\u0165 politiky (pokud se identifik\u00e1tor li\u0161\u00ed od mezipam\u011bti).<\/li>\n<\/ol>\n<p>\n<b>Podpora MTA-STS na stran\u011b odes\u00edlatele<\/b><\/p>\n<p>Zat\u00edm to nen\u00ed dobr\u00e9, proto\u017ee standard je nov\u00fd.<\/p>\n<ul>\n<li>Exim \u2014 nem\u00e1 vestav\u011bnou podporu, existuje extern\u00ed skript <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL\">https:\/\/github.com\/Bobberty\/MTASTS-EXIM-PERL<\/a><\/noindex>\u00a0<\/li>\n<li>Postfix \u2014 nem\u00e1 vestav\u011bnou podporu, je zde extern\u00ed skript, o kter\u00e9m je podrobn\u011b naps\u00e1no na Habru <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/post\/424961\/\">https:\/\/habr.com\/en\/post\/424961\/<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h1>Na z\u00e1v\u011br o \u00abmandatory TLS\u00bb<\/h1>\n<p>\nV posledn\u00ed dob\u011b se regul\u00e1to\u0159i zam\u011b\u0159uj\u00ed na bezpe\u010dnost e-mailu (a to je dobr\u00e9). Nap\u0159\u00edklad DMARC je povinn\u00fd pro v\u0161echny st\u00e1tn\u00ed instituce v USA a st\u00e1le \u010dast\u011bji je vy\u017eadov\u00e1n v oblasti financ\u00ed, v regulovan\u00fdch odv\u011btv\u00edch dosahuje zaveden\u00ed standardu 90%. N\u011bkte\u0159\u00ed regul\u00e1to\u0159i nyn\u00ed vy\u017eaduj\u00ed zaveden\u00ed \u00abmandatory TLS\u00bb pro jednotliv\u00e9 dom\u00e9ny, ale mechanismus zaji\u0161t\u011bn\u00ed \u00abmandatory TLS\u00bb nen\u00ed definov\u00e1n a v praxi je toto nastaven\u00ed \u010dasto zavedeno zp\u016fsobem, kter\u00fd ani minim\u00e1ln\u011b nechr\u00e1n\u00ed p\u0159ed skute\u010dn\u00fdmi \u00fatoky, kter\u00e9 jsou ji\u017e p\u0159edv\u00edd\u00e1ny v takov\u00fdch mechanismech jako DANE nebo MTA-STS.<\/p>\n<p>Pokud regul\u00e1tor vy\u017eaduje realizaci \u00abmandatory TLS\u00bb pro jednotliv\u00e9 dom\u00e9ny, doporu\u010dujeme zv\u00e1\u017eit MTA-STS nebo jeho \u010d\u00e1ste\u010dn\u00fd ekvivalent jako nejvhodn\u011bj\u0161\u00ed mechanismus, kter\u00fd eliminuje pot\u0159ebu prov\u00e1d\u011bt zabezpe\u010den\u00e1 nastaven\u00ed pro ka\u017edou dom\u00e9nu zvl\u00e1\u0161\u0165. Pokud m\u00e1te pot\u00ed\u017ee s realizac\u00ed klientsk\u00e9 \u010d\u00e1sti MTA-STS (zat\u00edmco protokol je\u0161t\u011b nez\u00edskal \u0161irokou podporu, pravd\u011bpodobn\u011b budou), lze doporu\u010dit takov\u00fd p\u0159\u00edstup:<\/p>\n<ol>\n<li>Publikujte politiku MTA-STS a\/nebo z\u00e1znamy DANE (DANE m\u00e1 smysl p\u0159id\u00e1vat, pouze pokud je pro va\u0161i dom\u00e9nu ji\u017e aktivov\u00e1n DNSSEC, a MTA-STS v ka\u017ed\u00e9m p\u0159\u00edpad\u011b), to ochr\u00e1n\u00ed provoz sm\u011brem k v\u00e1m a zbav\u00ed v\u00e1s nutnosti \u017e\u00e1dat jin\u00e9 e-mailov\u00e9 slu\u017eby o nastaven\u00ed mandatory TLS pro va\u0161i dom\u00e9nu, pokud e-mailov\u00e1 slu\u017eba ji\u017e podporuje MTA-STS a\/nebo DANE.<\/li>\n<li>Pro velk\u00e9 po\u0161tovn\u00ed slu\u017eby implementujte \"analog\" MTA-STS prost\u0159ednictv\u00edm samostatn\u00fdch nastaven\u00ed transportu pro ka\u017edou dom\u00e9nu, kter\u00e9 zafixuj\u00ed MX pou\u017e\u00edvan\u00fd pro p\u0159epos\u00edl\u00e1n\u00ed po\u0161ty a budou vy\u017eadovat povinnou kontrolu TLS certifik\u00e1tu. Pokud dom\u00e9ny ji\u017e publikuj\u00ed politiku MTA-STS, pravd\u011bpodobn\u011b to p\u016fjde prov\u00e9st bez probl\u00e9m\u016f. Samo o sob\u011b zaveden\u00ed povinn\u00e9ho TLS pro dom\u00e9nu bez zafixov\u00e1n\u00ed rel\u00e9 a kontroly certifik\u00e1tu nen\u00ed na \u00farovni bezpe\u010dnosti efektivn\u00ed a nic nep\u0159id\u00e1v\u00e1 k dosavadn\u00edm mechanism\u016fm STARTTLS.<\/li>\n<\/ol>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/515746\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e MTA-STS \u2014 \u044d\u0442\u043e \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u0430 \u043e\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 (\u0442.\u0435. \u0430\u0442\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a-\u0432-\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 aka MitM) \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0440\u0435\u0448\u0430\u0435\u0442 \u0443\u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u0432 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u0435\u0436\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 RFC 8461. \u041f\u043e\u0447\u0442\u0430 Mail.ru \u2014 \u043f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u043f\u043e\u0447\u0442\u043e\u0432\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0430\u044f \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442. \u0410 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-20T17:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mail.ru za\u010d\u00edn\u00e1 v testovac\u00edm re\u017eimu aplikovat politiky MTA-STS | ProHoster","description":"Pokud stru\u010dn\u011b, pak.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0447\u0442\u0430 Mail.ru \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 MTA-STS | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u0442\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/pochta-mail-ru-nachinaet-v-testovom-rezhime-primenyat-politiki-mta-sts","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-20T17:42:11+00:00","article:modified_time":"2020-08-20T17:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:26","updated":"2022-09-27 15:16:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=91951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/91952"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=91951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=91951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=91951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}