tls_policy

# Generated at 2024-05-24 20:50:45 by https://github/tmolitor-stud-tu/postfix-tls-policy generator
# Used commandline arguments: ./scripts/update.py --min-security fingerprint --no-mixed-lowest --no-dane --include-policy domains.txt

# Matched cert names for nexthop, dot-nexthop
126.com		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
aok.de		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
aol.asia		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.at		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.be		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.ch		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.cl		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.co.nz		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.co.uk		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.ar		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.au		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.br		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.co		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.mx		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.tr		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.com.ve		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.cz		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.de		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.dk		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.es		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.fi		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.fr		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.in		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.it		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.jp		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.nl		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.pl		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.se		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
aol.tw		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Matched cert names for nexthop, dot-nexthop
arcor.de		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
badv.bund.de		secure match=.bund.de

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bafza.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bakoev.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bamf.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
barch.bund.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
barmer-gek.de		secure match=.mas.t-systems-service.com:mas.t-systems-service.com

# Unmatched cert names and untrusted CA, fixing using explict listed fingerprints
bayern.de		fingerprint match=C0:9A:9B:38:11:4B:13:63:BB:A1:B9:47:98:23:10:9D:DA:FF:DA:64:3A:0B:99:B8:E1:9D:5F:F8:53:77:21:B1

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bdbos.bund.de		secure match=nexthop:dot-nexthop:hostname

# WARNING: Mixed results: MXs ['secondary.snafu.de'] do not serve a verifiable certificate, ignoring these!
# WARNING: Mixed results: MXs ['secondary.snafu.de'] do not have matching hostnames in certificate, ignoring these!
# Matched cert names for nexthop, dot-nexthop
berlin.de		secure match=nexthop:dot-nexthop

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bfdi.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bfr.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bkm.bmi.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bmas.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bmfsfj.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bmg.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bmvbs.bund.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
bmwi.bund.de		secure match=.bund.de

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bsi.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bstu.bund.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bund.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
bundestag.de		secure match=.dbtg.de

# Unmatched cert names, fixing using explictly listed names
bundeswehr.org		secure match=.bwehr.de:mforward.dtag.de

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
bverwg.bund.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
bzst.bund.de		secure match=.bund.de

# Unmatched cert names, fixing using explictly listed names
commerzbank.com		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
debian.org		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
email.de		secure match=.web.de

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
freenet.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
github.com		secure match=.google.com:.googlemail.com:.smtp.goog

# Unmatched cert names, fixing using explictly listed names
gitlab.com		secure match=.google.com:.googlemail.com:.smtp.goog

# Unmatched cert names, fixing using explictly listed names
gmail.com		secure match=.google.com:.googlemail.com:.smtp.goog

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
gmx.at		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
gmx.biz		secure match=.gmx.net

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
gmx.ch		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
gmx.co.uk		secure match=.gmx.net

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
gmx.com		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
gmx.com.my		secure match=.gmx.net

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
gmx.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
gmx.es		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.eu		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.fr		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.hk		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.info		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.it		secure match=.gmx.net

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
gmx.net		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
gmx.org		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.ph		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.pt		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.sg		secure match=.gmx.net

# Unmatched cert names, fixing using explictly listed names
gmx.us		secure match=.gmx.net

# Matched cert names for nexthop, dot-nexthop
google.com		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
googlegroups.com		secure match=.google.com:.googlemail.com:.smtp.goog

# Matched cert names for nexthop, dot-nexthop
googlemail.com		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
heise.de		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
hessen.de		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
hotmail.at		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.be		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.ch		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.id		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.jp		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.kr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.nz		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.th		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.uk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.co.za		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Matched cert names for nexthop, dot-nexthop
hotmail.com		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
hotmail.com.au		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.com.hk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.com.tr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.com.tw		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.com.vn		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
hotmail.cz		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
hotmail.de		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.dk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.es		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.fi		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.fr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.gr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.it		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.my		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
hotmail.nl		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
hotmail.no		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.ph		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.rs		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.se		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hotmail.sg		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
hs-hannover.de		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Matched cert names for nexthop, dot-nexthop
hu-berlin.de		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
icloud.com		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
informatik.hu-berlin.de		secure match=nexthop:dot-nexthop

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
kabelmail.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
live.at		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.be		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.ca		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.cl		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.cn		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.co.kr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.co.uk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.co.za		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.ar		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.au		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.mx		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.my		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.ph		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.pt		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.com.sg		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.de		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.dk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.fr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.hk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.ie		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.in		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.it		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.jp		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.nl		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.no		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.ru		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
live.se		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
livemail.tw		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
mac.com		secure match=.mail.icloud.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
mail.de		secure match=nexthop:dot-nexthop:hostname

# WARNING: Mixed results: MXs ['mx-n.mailbox.org'] do not serve a verifiable certificate, ignoring these!
# WARNING: Mixed results: MXs ['mx-n.mailbox.org'] do not provide TLS at all, ignoring these!
# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
mailbox.org		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
me.com		secure match=.mail.icloud.com

# Unmatched cert names, fixing using explictly listed names
msn.cn		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Matched cert names for nexthop, dot-nexthop
netcologne.de		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
niedersachsen.de		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
online.de		secure match=.ionos.co.uk:.ionos.de:.ionos.es:.ionos.fr:.ionos.it:.kundenserver.de

# Matched cert names for nexthop, dot-nexthop
orange.fr		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
ostfalia.de		secure match=.sonia.de

# Unmatched cert names, fixing using explictly listed names
outlook.at		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.be		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.co.id		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.co.jp		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:.xserver.jp:mail.messaging.microsoft.com:outlook.com:xserver.jp

# Unmatched cert names, fixing using explictly listed names
outlook.co.nz		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.co.th		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Matched cert names for nexthop, dot-nexthop
outlook.com		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
outlook.com.au		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.com.tr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
outlook.cz		secure match=nexthop:dot-nexthop:hostname

# Matched cert names for nexthop, dot-nexthop
outlook.de		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
outlook.dk		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.es		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.fr		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.it		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.my		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.ph		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
outlook.sg		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
paypal.com		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
paypal.de		secure match=nexthop:dot-nexthop:hostname

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
polizei.bund.de		secure match=nexthop:dot-nexthop:hostname

# Matched cert names for nexthop, dot-nexthop
postbank.de		secure match=nexthop:dot-nexthop

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
posteo.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
reply.github.com		secure match=.smtp.ghe.com:.smtp.github.com:smtp.ghe.com:smtp.github.com

# Matched cert names for nexthop, dot-nexthop
t-online.de		secure match=nexthop:dot-nexthop

# Matched cert names for nexthop, dot-nexthop
tk.de		secure match=nexthop:dot-nexthop

# Unmatched cert names and untrusted CA, fixing using explict listed fingerprints
torproject.org		fingerprint match=17:AE:A2:13:F8:4C:C0:84:D8:24:A3:27:A9:8B:E2:40:08:75:4F:32:59:F7:A9:BE:BA:4D:4C:9A:96:26:13:0F

# Unmatched cert names, fixing using explictly listed names
tu-clausthal.de		secure match=.mx.srv.dfn.de:mx.srv.dfn.de

# Unmatched cert names, fixing using explictly listed names
uni-osnabrueck.de		secure match=.mx.srv.dfn.de:mx.srv.dfn.de

# Unmatched cert names and untrusted CA, fixing using explict listed fingerprints
unitymedia.de		fingerprint match=BE:B0:F6:71:8C:1A:69:74:C4:06:56:0A:30:9E:4D:72:50:4E:BE:2D:2B:8D:CE:EC:9F:EA:95:2F:48:C9:D7:EB

# Unmatched cert names, fixing using explictly listed names
uos.de		secure match=.mx.srv.dfn.de:mx.srv.dfn.de

# Matched cert names for nexthop, dot-nexthop
vodafone.de		secure match=nexthop:dot-nexthop

# MX records could be resolved using DNSSEC, we can trust the hostname from DNS for cert validation
# Matched cert names for nexthop, dot-nexthop, hostname
web.de		secure match=nexthop:dot-nexthop:hostname

# Unmatched cert names, fixing using explictly listed names
windowslive.com		secure match=.mail.protection.outlook.de:.mx.microsoft:.outlook.com:.pamx1.hotmail.com:mail.messaging.microsoft.com:outlook.com

# Unmatched cert names, fixing using explictly listed names
wsv.bund.de		secure match=.gbbmvi-wan.de

# Unmatched cert names, fixing using explictly listed names
yahoo.at		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.be		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.ca		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.id		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.il		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.in		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Matched cert names for nexthop, dot-nexthop
yahoo.co.jp		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
yahoo.co.nz		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.th		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.uk		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.co.za		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Matched cert names for nexthop, dot-nexthop
yahoo.com		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
yahoo.com.ar		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.br		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.co		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.hk		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.my		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.ph		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.sg		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.tr		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.tw		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.com.vn		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.cz		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.de		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.dk		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.es		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.fi		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.fr		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.gr		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.hu		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.ie		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.in		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.it		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.nl		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.no		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.pl		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.pt		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.ro		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Unmatched cert names, fixing using explictly listed names
yahoo.se		secure match=.biz.mail.yahoo.com:.yahoodns.net

# Matched cert names for nexthop, dot-nexthop
yandex.ru		secure match=nexthop:dot-nexthop

# Unmatched cert names, fixing using explictly listed names
ymail.com		secure match=.biz.mail.yahoo.com:.yahoodns.net