Is it possible with Postfix to add a warning to all emails received over a cleartext (non-TLS) connection?
For example modifying the subject and/or adding a custom header.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityIs it possible with Postfix to add a warning to all emails received over a cleartext (non-TLS) connection?
For example modifying the subject and/or adding a custom header.
The way to go here is to first tell Postfix to add the TLS connection status into the Received header. In /etc/postfix/main.cf
add
smtpd_tls_received_header = yes
This will add something like (using TLSv1.2 with cipher … (256/256bits))
to the postfix generated received header.
This information can then be used to add a custom headers. E.g. one could add a X-Transport-Layer-Security
header and set its value depending on whether the above snippet is present in the Received header. Possible methods to do so include
I don't know of any ready-made solution to do this, but it shouldn't be much work either.
editheader
extension might be the easiest way to go. Info here: mvmf.org/docs/draft-degener-sieve-editheader-00.txt (section 5). To send your email over to the Sieve rules you might want to follow my answer here unix.stackexchange.com/a/252907/23085. Use the same procedure but just pipe the emails directly to Dovecot local delivery and require editheader
extension. The code should be easy to come with following the examples on the link.