This is my current configuration:

I have two servers:

  • Server A is accessible with domain.tld
  • Server B is accesslble with sub.domain.tld

In the DNS record MX for domain.tld point to sub.domain.tld

My postfix server is installed on server B and send mails with the form user@domain.tld instead of user@sub.domain.tld

Both servers run under Debian and for SSL web access let's encrypt is currently the one who manage certificates for domain.tld and sub.domain.tld, since I am not sure how wildcard are managed with let's encrypt both domains have there own certificates instead of sharing the same.

For my question:

Now that I managed to configure SPF, DKIM and DMARK for the postfix server, I wanted to setup TLS, but I am not sure which certificate is the correct one to use in this configuration. Since postfix is installed on Server B/sub.domain.tld, should I use the certificate for this domain? Or with my mails using the format of Server A/domain.tld should I copy and use the certificate from Server A instead?


Remember, any domain can have its mail serviced by any other domain.

The certificate name should match whatever name the server uses in server to server SMTP, mail client use via authenticated smtp or Submission, etc. Otherwise you'll get hostname and certificate mismatch errors. This same name should match with whatever reverse DNS shows up as for the IP, and this name should be what is listed in SPF records, etc.

  • I assume I should have thought about the reverse DNS for which certificate to choose. That's a good reminder for situations like that I suppose – Kane Jun 7 '18 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.