Why does MTA-STS and DANE need to be disabled when using a relay host?

[mamiu]

At the end of the section Relay host in the docs it says:

Note: When using a relay host, make sure both MTA-STS and DANE are disabled in the configuration file:

[queue.outbound.tls]
mta-sts = "disable"
dane = "disable"

Why is this a requirement?

I want to configure one central mail server that handles all mailboxes but is only responsible for receiving and storing emails. For the sending part I'd like to use several relay hosts (one per domain) without having to disable either of these security standards.

---

PS: I believe this config should work to configure a relay host per domain:

[queue.outbound]
next-hop = [
  { if = "to_lowercase(sender_domain) == 'domain1.com'", then = "'domain1-relay'" }, 
  { if = "to_lowercase(sender_domain) == 'domain2.com'", then = "'domain2-relay'" }, 
  { else = false }
]

[remote."domain1-relay"]
address = "relay.domain1.com"
port = 25
protocol = "smtp"
auth.username = "SMTP_AUTH_USERNAME"
auth.secret = "SMTP_AUTH_PASSWORD"

[remote."domain2-relay"]
address = "relay.domain2.com"
port = 25
protocol = "smtp"
auth.username = "SMTP_AUTH_USERNAME"
auth.secret = "SMTP_AUTH_PASSWORD"

[mdecimus]

Why is this a requirement?

Both MTA-STS and DANE require validating remote server's TLS certificates. If you use a relay host Stalwart cannot perform this validation since it is not delivering the message.

[mamiu]

But MTA-STS and DANE are also used for inbound, not just outbound. Or does inbound still work even if they're disabled?

[mdecimus]

You enable inbound MTA-STS and DANE on your DNS server. Outbound MTA-STS and DANE is enabled by the remote host so you need to disable validating them if a relay host is used.

[mamiu]

Thanks for your response @mdecimus. Makes sense.

BTW: Both links (MTA-STS and DANE) in the Relay host example lead to sections on the TLS page that are not documented yet:

• MTA-STS: https://stalw.art/docs/smtp/outbound/tls#mta-sts
• DANE: https://stalw.art/docs/smtp/outbound/tls#dane