Re: MTA-STS, was Not So Massive change in Public Cert behaviour coming soon

["John R. Levine via NANOG" <nanog () lists nanog org>]

On Mon, 19 May 2025, Bjørn Mork wrote:
> > MTA-STS does the same thing more kludgily for people who don't like DNSSEC.
> What if I don't like public CA certificates for email servers?

If you don't like it, don't use it.  The IETF isn't the Network Police.

> Will MTA-STS stay optional, or will it be "optional" like DKIM and SPF?

Given that it does something completely different and is intnded to 
protect mail you receive rather than mail you send, no.

> Why don't we just deprecate MTA-STS and make DANE mandatory, while it is
> still possible?

It's an open secret that MTA-STS exists because one of the large mail 
providers doesn't want to use DNSSEC.  The IETF is still not the Network 
Police so there's nothing we can do about it.

R's,
John
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/JZBNLZXH3XVDOQZH3HTFPGD6UZ7UT7JM/