• MailTransfer
• HowToConnectMultipleDomainsViaTLS

• To Configure MailTransfer Agents - To Server Certificate FAQs

Project: How To Connect Multiple Email Domains via TLS

Given Sample

• 3 dedicated Email domains by 3 companies, each on its own LAN secured by firewalls
• Each company uses its own Server certs
  1. Company A (domainA.tld) uses CAcert server certs
  2. Company B (domainB.tld) uses Verisign server certs

  3. Company C (domainC.tld) uses GeoTrust server certs

     • using 3 different CA's in example for 3 different companies is only to show that there is no requirement to use all the same CA but using all the same CA simplifies the rollout

Objectives

• connect 3 foreign individual companies with a minimal agreement to transport B2B email securely via TLS over the internet
• configure the internet gateways to enable TLS
• configure the internet gateways to support TLS connection for specific target email domains

• Pros:

  • Companies requires to configure their internet gateways only (in a first step to transfer their business emails securely from one company to another over the internet)
  • In a later project step Client Certs usage can be rolled out
  • Not all users in all connected companies requires to have a client cert
  • User education using client certs is not a requirement in starting securing B2B communication (but may be at a later project step)

• Cons:

  • Email admins configuring the companies internet gateways have to work together
  • Using client certs of a CA that isn't included in the major browsers/OS'ses/applications requires an administrative software/policy rollout of the roots in the companies intranet that probably requires rewriting of company policies

Configure Internet Gateways for using TLS connectivity

• Internet Gateways configuration
  1. Company A (domainA.tld)
     • create and configure own server cert gatewayA.domainA.tld
     • dedicated routing to domainB.tld, domainC.tld
     • enable TLS connection for dedicated routings
     • make Roots- and Intermediate Certificates known to Internetgateway server of Company A
       1. CAcert root/subroot
       2. Verisign root/subroot

       3. GeoTrust root/subroot

  2. Company B (domainB.tld)
     • create and configure own server cert gatewayB.domainB.tld
     • dedicated routing to domainA.tld, domainC.tld
     • enable TLS connection for dedicated routings
     • make Roots- and Intermediate Certificates known to Internetgateway server of Company B
       1. CAcert root/subroot
       2. Verisign root/subroot

       3. GeoTrust root/subroot

  3. Company C (domainC.tld)
     • create and configure own server cert gatewayC.domainC.tld
     • dedicated routing to domainA.tld, domainB.tld
     • enable TLS connection for dedicated routings
     • make Roots- and Intermediate Certificates known to Internetgateway server of Company C
       1. CAcert root/subroot
       2. Verisign root/subroot

       3. GeoTrust root/subroot

• Then each connection from DomainA goes via TLS to DomainB and via TLS to DomainC,
• each connection from DomainB goes via TLS to DomainA and via TLS to DomainC and
• each connection from DomainC goes via TLS to DomainA and via TLS to DomainB
• Default SMTPS port: 465
• Configure each SMTP connector on all internet gateways to support port 25 (non-secure channel) and port 465 for TLS channel
• Sample for one connector (domainA.tld) (postfix):
  • main.cf file:

    •     transport_maps = hash:/etc/postfix/transport
          smtp_tls_security_level = may
          smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

  • tls_policy:

    •     domainB.tld may
          .domainB.tld may
          domainC.tld may
          .domainB.tld may

  • transport file:

    •     # add specific relayhosts for specific domains
          # Specifies specific domains for local delivery
         domainA.tld :
         # Specify all subdomains for local delivery
         .domainA.tld :
         // route-to DomainB.tld, DomainC.tld using TLS
         domainB.tld      :[gatewayB.domainB.tld]:465
         .domainB.tld      :[gatewayB.domainB.tld]:465
         domainC.tld      :[gatewayC.domainC.tld]:465
         .domainC.tld      :[gatewayC.domainC.tld]:465

    • More sample configurations: How to setup Relay host in mail server

    • More info on TLS with postfix Using TLS for mail delivery from postfix to another TLS activated mail server

    • Exchange Server: configure routing group connectors

• CategoryCommunity

• CategoryConfiguration

• CategoryGuide

• CategorySoftware

• CategorySupport