8

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI correctly here and it works for HTTPS.

I've also set up MX for both domain to point to server. I've set up a SMTP server listening and it's responding correctly on port 25 by deducing the allowed host from the email address and rejecting any other host's emails.

I've set up TLS for this server but it only allows a single SSL certificate (either for example.com or for example.net). Is there a way, with SMTP, to use SNI (or an equivalent ?) so that, depending on which destination it present the right TLS certificate ?

So far, I haven't found anything for this. My current strategy is to either use a different IP for the different domain (might be possible with IPv6, but not for IPv4 in my case) and run two SMTP servers (one for each host) and a firewall rule to redirect to the different port based on destination IP. This is cumbersome for 2 domains, but if you have more domains, let's say 10 domains, it's not viable at all.

Is there a better strategy ? How do large service providers deals with SMTP for numerous hosts ?

1 Answer 1

8

SNI is not needed here. The verification of the certificate host name is performed against the hostname returned by the MX record, not the domain name in the target email address. So as long as you have made sure that all the MX records for all your domains point to the same hostname, you only need a certificate for that hostname.

In other words, if you have an MX record stating that all emails to the domain example.com should be handled by the mailserver mail.example.net, then the mailserver needs to have a certificate for the hostname mail.example.net only.

5
  • Ok, I'll try that and came back to you.
    – xryl669
    May 15, 2019 at 14:29
  • It's still failing on dotcom-tools.com/email-server-test.aspx ... strange. It's also failing for a large mail server (OVH.com) I'm using for another domain. So maybe the tool is wrong in its report.
    – xryl669
    May 15, 2019 at 14:33
  • It's hard to say what the issue could be unless you tell us the actual domain name you're checking. But the email server test you linked to doesn't seem to do any MX lookups before testing the server, so I'm not sure it actually tests the whole chain of domain name -> MX record -> SSL certificate.
    – Jenny D
    May 15, 2019 at 15:41
  • Right, I've come to the same conclusion. Tried other test service and your advice was correct. Accepted your answer, thank you.
    – xryl669
    May 15, 2019 at 15:51
  • @xryl669 Glad I could be of help!
    – Jenny D
    May 15, 2019 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .