GhettoForge quick start guide
/usr/share/doc/postfix-tlspol/README.gf

This guide assumes that postfix >= 3.10 is already installed and running

*****************************
A. After initial installation 
*****************************

###########
DNS Server:
###########

The DNS server must be DNSSEC capable
If DNS is hosted on 127.0.0.1:53, it will already work by default. Alternatively,
set the DNS server in /etc/postfix-tlspol/config.yaml

Earlier README.md versions recommended adding the follow to unbound DNS configuration to assist with caching but
this may no longer be useful postfix-tlspol v1.9.0 when the note was removed.

cache-min-ttl: 10
cache-max-ttl: 240
serve-original-ttl: yes



##########
Postfix:
##########

Include the following minimum postfix configuration.

/etc/postfix/main.cf
-----------------------------------------------------------------------
smtp_dns_support_level = dnssec
smtp_tls_security_level = dane
smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8642:QUERYwithTLSRPT
-----------------------------------------------------------------------
(Use "smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8642:QUERY" for postfix < 3.10 )

run the following to commit the changes to postfix
postfix.reload


This also enables TLSRPT support. See
https://www.postfix.org/TLSRPT_README.html
https://github.com/sys4/tlsrpt-reporter


###################
Socket vs. Service:
###################

Ther are two systemd units:
postfix-tlspol.service (service)
postfix-tlspol.socket (socket)

When postfix smtp_tls_policy_maps is configured to use postfix-tlspol then
postfix will defer delivery if neither the service nor socket is running!

The postfix-tlspol.service is able to prefetch and must always be enabled/running for best performance.

The socket is OPTIONAL and was introduced in postfix-tlspol v1.9.0 to keep the port available
for lookups during periods when the service is temporarily offline.

The socket normally works in forwarding mode and sends lookups to the service.
It is also able to perform lookups when the service is offline but with reduced performance. 

WARNING: When using the socket it must always be running before starting the service.


To enable and start the socket and service after the first install.
------------------------------------------------
systemctl enable --now postfix-tlspol.socket
systemctl enable --now postfix-tlspol.service
------------------------------------------------


************************
B. After package updates 
************************

The rpm from GhettoForge is designed to enable and start the service and socket only if they were already
enabled and started before the update. (Preserves state)

To enable/start the socket for the first time when the service is already enabled and running:
-------------------------------------
systemctl stop postfix-tlspol.service
systemctl enable --now postfix-tlspol.socket
systemctl start postfix-tlspol.service
-------------------------------------


**********
C. Testing 
**********

1. Can run the following for postfix-tlspol usage
-------------------------------------------------
/usr/bin/postfix-tlspol --help


2. To test postfix lookups
---------------------------
The command below is a quick way to test that postfix lookups are working after installs/updates.
The desired response when looking up a domain with valid TLSA records will be "dane-only":

postmap -q "example.com" socketmap:inet:127.0.0.1:8642:QUERYwithTLSRPT


3. General testing
------------------
Use the following for general testing of configuration or to examine DNS records of a domain 

/usr/bin/postfix-tlspol -config /etc/postfix-tlspol/config.yaml -query example.com


4. Postfix logs
---------------
Postfix will not log records with the keywords "dane-only", "3 1 1", or "TLSA" unless smtp_tls_loglevel >=2 in /etc/postfix/main.cf
After increasing log verbosity it will be possible to search for these keywords for subsequent deliveries:

grep "TLSA" /var/log/maillog