Shared outbound TLS crate for the relay

jcoffey-dev commented

2026-10-30 14:11:15 +00:00

Owner

Part 4b of relay outbound: RL-30's "small shared crate". This moves the server's outbound DANE and MTA-STS code into crates/outbound-tls (inbuxa-outbound-tls), so the relay can deliver with the same logic instead of a second copy. Delivery itself is 4c. This PR doesn't depend on #258.

What moved

From common: the Tlsa, TlsaEntry, TlsaMatching, Policy, Mode and MxPattern types, and their Display/FromStr impls. common::config::smtp::resolver re-exports them, so paths elsewhere are unchanged. Policy::try_parse, which reads this server's own settings, stays in common as mta_sts_policy().
From smtp:
- the DANE certificate check, now dane::verify, which returns a match or failure;
- MTA-STS policy parsing and matching, now inherent methods on Policy. The old ParsePolicy/VerifyPolicy traits are gone and a few imports changed;
- the DNSSEC lookups for MX, TLSA, A and AAAA, including the bogus-answer recheck. They're plain functions over the validating and plain resolvers, and each answer comes back with how long it can be cached.
The CacheItemWeight impls for Tlsa and Policy move to utils::cache (orphan rule).

What stayed in smtp

The TlsaLookup wrappers on Server: its caches, the dnssec_available fallback, and the test_mode mocks.
TlsaVerify on Tlsa, which raises the same dane.* trace events in the same order and returns the same queue errors.
The MTA-STS policy fetch (reqwest) and its cache.

The crate depends on mail-auth without its report and key-generation features, so the relay will avoid pulling those in. Against the relay's current dependency tree, it adds about 60 crates, mostly hickory and IDNA. The size cost will be measured in 4c, when the relay links it.

Tests

The crate's own tests pass: 11, including the moved tlsa_base_status, secure_alias, apex_status and IDN policy tests; the 2 live-DNS tests stay ignored.
smtp unit tests pass with test_mode.
The full smtp:: suite in the tests crate passes: 78, with the usual 3 network-only tests ignored. That covers all of DANE (including bogus-DNSSEC deferral and the TA/EE chain cases), MTA-STS, and delivery.
fmt, clippy, and the notice, name, context and privacy checks are clean.

Part 4b of relay outbound: RL-30's "small shared crate". This moves the server's outbound DANE and MTA-STS code into `crates/outbound-tls` (`inbuxa-outbound-tls`), so the relay can deliver with the same logic instead of a second copy. Delivery itself is 4c. This PR doesn't depend on #258. **What moved** - From `common`: the `Tlsa`, `TlsaEntry`, `TlsaMatching`, `Policy`, `Mode` and `MxPattern` types, and their `Display`/`FromStr` impls. `common::config::smtp::resolver` re-exports them, so paths elsewhere are unchanged. `Policy::try_parse`, which reads this server's own settings, stays in `common` as `mta_sts_policy()`. - From `smtp`: - the DANE certificate check, now `dane::verify`, which returns a match or failure; - MTA-STS policy parsing and matching, now inherent methods on `Policy`. The old `ParsePolicy`/`VerifyPolicy` traits are gone and a few imports changed; - the DNSSEC lookups for MX, TLSA, A and AAAA, including the bogus-answer recheck. They're plain functions over the validating and plain resolvers, and each answer comes back with how long it can be cached. - The `CacheItemWeight` impls for `Tlsa` and `Policy` move to `utils::cache` (orphan rule). **What stayed in `smtp`** - The `TlsaLookup` wrappers on `Server`: its caches, the `dnssec_available` fallback, and the `test_mode` mocks. - `TlsaVerify` on `Tlsa`, which raises the same `dane.*` trace events in the same order and returns the same queue errors. - The MTA-STS policy fetch (reqwest) and its cache. The crate depends on mail-auth without its report and key-generation features, so the relay will avoid pulling those in. Against the relay's current dependency tree, it adds about 60 crates, mostly hickory and IDNA. The size cost will be measured in 4c, when the relay links it. **Tests** - The crate's own tests pass: 11, including the moved `tlsa_base_status`, `secure_alias`, `apex_status` and IDN policy tests; the 2 live-DNS tests stay ignored. - smtp unit tests pass with `test_mode`. - The full `smtp::` suite in the tests crate passes: 78, with the usual 3 network-only tests ignored. That covers all of DANE (including bogus-DNSSEC deferral and the TA/EE chain cases), MTA-STS, and delivery. - fmt, clippy, and the notice, name, context and privacy checks are clean.

jcoffey-dev added 1 commit 2026-10-30 14:11:15 +00:00

Shared outbound TLS crate for the relay

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 12m6s

Details

bda032d51d

The TLSA and MTA-STS types, the DANE certificate check, MTA-STS policy
parsing and matching, and the DNSSEC lookups with the bogus-answer
recheck move out of crates/smtp and crates/common into
crates/outbound-tls (RL-30), so inbuxa-relay can deliver with the same
code. The server keeps its caches, trace events, policy fetch and test
mocks around them; its behavior is unchanged.

jcoffey-dev added 1 commit 2026-10-30 15:10:07 +00:00

Merge remote-tracking branch 'origin/main' into relay/outbound-tls

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 29m7s

Details

6d3f23dee6

# Conflicts:
#	docs/spec/features/relay.md

jcoffey-dev merged commit f50ad80a95 into main

2026-10-30 15:39:43 +00:00

jcoffey-dev deleted branch relay/outbound-tls

2026-10-30 15:39:43 +00:00

jcoffey-dev referenced this pull request

2026-10-30 15:41:37 +00:00

relay: deliver outbound mail #260

Shared outbound TLS crate for the relay #259