Chapter 05 Networking, DNS & Crypto Admin: #pTls

Let's Encrypt ACME v2 (0 ms SNI), MTA-STS, DANE & BIMI

SharpMailserver automates X.509 certificate issuance and renewal via Let's Encrypt ACME v2, hot-swapping renewed certificates in 0 ms across HTTPS, SMTPS, STARTTLS, IMAPS, and ManageSieve with zero dropped connections.

Operational Tip & Architecture Note

Crucial DANE (TLSA) detail: always publish DANE records using Usage 3, Selector 1 (SPKI public key), MatchingType 1 (SHA-256), i.e. '3 1 1'. Never use '3 0 1' (full cert hash) with automated 60-day Let's Encrypt renewals unless automating DNS updates!

DANE TLSA (3 1 1) & MTA-STS DNS Records

Your active certificate's exact SPKI SHA-256 digest is computed copy-ready inside #pTls in the Admin Cockpit.

Reference / Configuration

_25._tcp.mail.firma.de.  3600 IN TLSA 3 1 1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
_mta-sts.firma.de.       3600 IN TXT  "v=STSv1; id=20261030"
_smtp._tls.firma.de.     3600 IN TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@firma.de"
default._bimi.firma.de.  3600 IN TXT  "v=BIMI1; l=https://mail.firma.de/bimi/firma.de/logo.svg;"

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`ACME SAN-Domains (#pTls)`	Subject Alternative Names included in the Let's Encrypt certificate, renewed automatically 30 days prior to expiry.	`ServerHostName vorausgewählt`	Include ONLY hostnames whose public A/AAAA records point to this server! Including a root domain hosted elsewhere will fail HTTP-01 validation.
`MTA-STS & TLS-RPT (RFC 8461 / 8460)`	Instructs sending MTAs via HTTPS policy to deliver mail to your domain strictly over authenticated TLS.	`Integrierter Policy-Endpunkt`	Start in testing mode while monitoring TLS-RPT reports in /admin/, then switch policy mode to enforce.
`DANE TLSA (_25._tcp.<ServerHostName>)`	Pins your server's SubjectPublicKeyInfo SHA-256 digest in DNSSEC-signed DNS (_25._tcp.mail.company.com).	`3 1 1 <SPKI-SHA256-Hash>`	Publish ONLY on DNSSEC-signed zones using the exact '3 1 1' SPKI SHA-256 record generated in #pTls.
`BIMI Markenlogo (default._bimi)`	Displays your verified brand mark (SVG Tiny 1.2 PS) next to your messages in supporting mail clients.	`Integrierter SVG-Sanitizer`	Requires DMARC p=quarantine or p=reject. Upload your SVG in #pTls to sanitize and host it automatically with proper CORS headers.