jcoffey-dev
a41b840e5e
The relay now sends what the downstream hands it: by MX, one domain at a time, with DANE where the MX and the host's addresses are signed and its TLSA records are, MTA-STS where the domain enforces a policy, and otherwise STARTTLS per the new outboundTls setting. Each recipient's deliveryStatus is the remote server's own reply; retries follow outboundRetry, and what is still queued at expiresAt is refused with the last reply. Sessions report outbound.attempt and outbound.tls events, the latter for TLS-RPT. DNS, DANE and MTA-STS come from crates/outbound-tls.