Internet Assigned Numbers Authority
  • Domains
  • Protocols
  • Numbers
  • About

                                                           STARTTLS Validation Result Types

Created
        2018-06-14

Last Updated
        2018-09-28

Available Formats
        [IMG]
        XML [IMG]
        HTML [IMG]
        TXT

Registry Included Below

  • STARTTLS Validation Result Types

STARTTLS Validation Result Types

Registration Procedure(s)

             Expert Review


Expert(s)

             Alexander Brotman, Daniel Margolis, Viktor Dukhovni


Reference
        [RFC 8460]

Available Formats
        [IMG]
        CSV

       Result Type                                                           Description                                                    Reference
starttls-not-supported    This indicates that the recipient MX did not support STARTTLS.                                                    [RFC 8460]
                          This indicates that the certificate presented did not adhere to the constraints specified in the MTA-STS or DANE
certificate-host-mismatch policy, e.g., if the MX hostname does not match any identities listed in the subject alternative name (SAN) [RFC  [RFC 8460]
                          5280].
certificate-expired       This indicates that the certificate has expired.                                                                  [RFC 8460]
tlsa-invalid              This indicates a validation error in the TLSA record associated with a DANE policy. None of the records in the    [RFC 8460]
                          RRset were found to be valid.
dnssec-invalid            This indicates that no valid records were returned from the recursive resolver.                                   [RFC 8460]
                          This indicates that the sending system is configured to require DANE TLSA records for all the MX hosts of the
dane-required             destination domain, but no DNSSEC-validated TLSA records were present for the MX host that is the subject of the  [RFC 8460]
                          report. Mandatory DANE for SMTP is described in [Section 6 of RFC 7672]. Such policies may be created by mutual
                          agreement between two organizations that frequently exchange sensitive content via email.
                          This is a label that covers multiple certificate-related failures that include, but are not limited to, errors
certificate-not-trusted   such as untrusted/unknown certification authorities (CAs), certificate name constraints, certificate chain        [RFC 8460]
                          errors, etc. When using this declaration, the reporting MTA SHOULD utilize the "failure-reason-code" to provide
                          more information to the receiving entity.
sts-policy-invalid        This indicates a validation error for the overall MTA-STS Policy.                                                 [RFC 8460]
sts-webpki-invalid        This indicates that the MTA-STS Policy could not be authenticated using PKIX validation.                          [RFC 8460]
validation-failure        This indicates a general failure for a reason not matching a category above. When using this declaration, the     [RFC 8460]
                          reporting MTA SHOULD utilize the "failure-reason-code" to provide more information to the receiving entity.
sts-policy-fetch-error    This indicates a failure to retrieve an MTA-STS policy, for example, because the policy host is unreachable.      [RFC 8460]

Licensing Terms