0.3.1

Fixes from a Codex code review of 0.3.0.

• CNAME MX hosts follow Postfix exactly: the first secure TLSA RRset (expanded name, then original) decides, a lookup failure stops. Before, an unusable or failing RRset at the CNAME target could fall back to the original name and answer dane-only where Postfix still defers. (#6)
• Request deadline enforced per recv(), a client dripping bytes can no longer stretch a request; replies are written with a timeout. (#7)
• Port ships its own danepolicy account (files/UIDs, files/GIDs via UID_FILES/GID_FILES) until the user is registered in the ports tree, so the README install path works; CI tests exactly that path. pkg-message uses %%PREFIX%%. (#8)
• TLSA full data (matching type 0) must be well-formed DER, cache lifetime includes CNAME TTLs, a socket in use is not replaced, cleanup only removes our own socket, stricter host name labels, explicit socket permission checks in CI. (#9)

Not adopted from the review: TEMP when only MX #11+ has TLSA - Postfix itself tries only smtp_mx_address_limit addresses, TEMP would block such domains permanently.

0.3.0

Security fixes from the review of 0.2.0, plus a fact-check of the docs.

• CNAME MX hosts: TLSA is looked up at the expanded name of a DNSSEC-validated alias first, then at the original name (RFC 7672 2.2.2). Before, such domains wrongly got NOTFOUND. (#1)
• Only usable TLSA counts (usage 2/3, selector 0/1, matching type 0/1/2). A host with only unusable records no longer gets dane-only, which would have made it unreachable.
• Unix socket + dedicated user by default: /var/run/postfix_dane_policy/policy.sock in a danepolicy:postfix 0750 directory, root-owned supervisor pidfile. (#2)
• Limits: max connections, request deadline (no slowloris), max 10 MX hosts, total lookup budget, merged concurrent lookups, non-loopback listen needs --allow-remote. (#3)
• Strict keys: IDNA 2008/UTS#46 to A-labels, invalid names are NOTFOUND, no log injection. (#4)
• Resolver self-test: if the resolver doesn't validate DNSSEC, every lookup answers TEMP. dnspython >= 2.6.1, idna, LRU cache, CI actions pinned by SHA, distinfo verified against the release tarball. (#5)
• Docs: tls_required_enable = no, CA trust store, smtp_tls_mandatory_protocols.

Upgrading from 0.2.x: a TCP setup keeps working. To switch, create the user (the port does it), drop the TCP args and point Postfix to socketmap:unix:/var/run/postfix_dane_policy/policy.sock:dane. See README.

0.2.0

FreeBSD is the primary platform now.

• CI builds the FreeBSD port from the current tree (portlint, stage, stage-qa, check-plist, package), installs the package, starts it via service(8) and queries it.
• --listen accepts IPv6 addresses (e.g. ::1).
• README and pkg-message describe the base system local_unbound as the default resolver.
• Port: no USE_PYTHON=concurrent any more, it renamed the daemon binary and man page.
• rc.d fixes found on a live jail: postfix_dane_policy_args instead of _flags, pidfile directory, no -u for daemon(8).

0.1.0

First release.

• Socketmap service for Postfix smtp_tls_policy_maps: dane-only for next-hop domains with DNSSEC validated MX and TLSA records, NOTFOUND otherwise, TEMP on DNS failures (Postfix defers instead of downgrading).
• Meant to run in front of an MTA-STS resolver with smtp_tls_security_level = verify: DANE if published, else MTA-STS, else a verified certificate, never plaintext.
• FreeBSD rc.d script, man page and a port skeleton under freebsd/mail/py-postfix-dane-policy.

Tested in production on FreeBSD 15.1 / Postfix 3.11.7 / Unbound.