Skip to content

Commit 828a1f4

Browse files
Initial commit
0 parents  commit 828a1f4

File tree

9 files changed

+234
-0
lines changed

9 files changed

+234
-0
lines changed

.nojekyll

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

.well-known/index.html

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<meta name="robots" content="noindex">
4+
<title>Redirecting to mta-sts.txt</title>
5+
<meta http-equiv="refresh" content="0; URL=mta-sts.txt">
6+
<link rel="canonical" href="mta-sts.txt">

.well-known/mta-sts.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: STSv1
2+
mode: [enforce|testing|none] # 1. Decide your mode.
3+
mx: mx1.your_domain.tld # 2. Add your primary mailserver hostname (see MX records in your DNS)
4+
mx: mx2.your_domain.tld # 3. If you have secondary mailservers, add one line for each.
5+
max_age: 604800 # 4. Depending on your mode above, 604800 seconds = 1 week might be a good value.
6+
# 5. Remove all the comments (if that wasn't obvious to you).

CODE_OF_CONDUCT.md

+125
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, religion, or sexual identity
10+
and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment for our
18+
community include:
19+
20+
* Demonstrating empathy and kindness toward other people
21+
* Being respectful of differing opinions, viewpoints, and experiences
22+
* Giving and gracefully accepting constructive feedback
23+
* Accepting responsibility and apologizing to those affected by our mistakes,
24+
and learning from the experience
25+
* Focusing on what is best not just for us as individuals, but for the
26+
overall community
27+
28+
Examples of unacceptable behavior include:
29+
30+
* The use of sexualized language or imagery, and sexual attention or
31+
advances of any kind
32+
* Trolling, insulting or derogatory comments, and personal or political attacks
33+
* Public or private harassment
34+
* Publishing others' private information, such as a physical or email
35+
address, without their explicit permission
36+
* Other conduct which could reasonably be considered inappropriate in a
37+
professional setting
38+
39+
## Enforcement Responsibilities
40+
41+
Community leaders are responsible for clarifying and enforcing our standards of
42+
acceptable behavior and will take appropriate and fair corrective action in
43+
response to any behavior that they deem inappropriate, threatening, offensive,
44+
or harmful.
45+
46+
Community leaders have the right and responsibility to remove, edit, or reject
47+
comments, commits, code, wiki edits, issues, and other contributions that are
48+
not aligned to this Code of Conduct, and will communicate reasons for moderation
49+
decisions when appropriate.
50+
51+
## Scope
52+
53+
This Code of Conduct applies within all community spaces, and also applies when
54+
an individual is officially representing the community in public spaces.
55+
Examples of representing our community include using an official e-mail address,
56+
posting via an official social media account, or acting as an appointed
57+
representative at an online or offline event.
58+
59+
## Enforcement
60+
61+
Any instances of abuse, harassment, or otherwise unacceptable behavior may be
62+
reported to the community leaders responsible for enforcement [here](https://github.com/jpawlowski/mta-sts.template#author).
63+
64+
All complaints will be reviewed and investigated promptly and fairly.
65+
66+
## Enforcement Guidelines
67+
68+
Community leaders will follow these Community Impact Guidelines in determining
69+
the consequences for any action they deem in violation of this Code of Conduct:
70+
71+
### 1. Correction
72+
73+
**Community Impact**: Use of inappropriate language or other behavior deemed
74+
unprofessional or unwelcome in the community.
75+
76+
**Consequence**: A private, written warning from community leaders, providing
77+
clarity around the nature of the violation and an explanation of why the
78+
behavior was inappropriate. A public apology may be requested.
79+
80+
### 2. Warning
81+
82+
**Community Impact**: A violation through a single incident or series
83+
of actions.
84+
85+
**Consequence**: A warning with consequences for continued behavior. No
86+
interaction with the people involved, including unsolicited interaction with
87+
those enforcing the Code of Conduct, for a specified period of time. This
88+
includes avoiding interactions in community spaces as well as external channels
89+
like social media. Violating these terms may lead to a temporary or
90+
permanent ban.
91+
92+
### 3. Temporary Ban
93+
94+
**Community Impact**: A serious violation of community standards, including
95+
sustained inappropriate behavior.
96+
97+
**Consequence**: A temporary ban from any sort of interaction or public
98+
communication with the community for a specified period of time. No public or
99+
private interaction with the people involved, including unsolicited interaction
100+
with those enforcing the Code of Conduct, is allowed during this period.
101+
Violating these terms may lead to a permanent ban.
102+
103+
### 4. Permanent Ban
104+
105+
**Community Impact**: Demonstrating a pattern of violation of community
106+
standards, including sustained inappropriate behavior, harassment of an
107+
individual, or aggression toward or disparagement of classes of individuals.
108+
109+
**Consequence**: A permanent ban from any sort of public interaction within
110+
the community.
111+
112+
## Attribution
113+
114+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
115+
version 2.0, available at
116+
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
117+
118+
Community Impact Guidelines were inspired by [Mozilla's code of conduct
119+
enforcement ladder](https://github.com/mozilla/diversity).
120+
121+
[homepage]: https://www.contributor-covenant.org
122+
123+
For answers to common questions about this code of conduct, see the FAQ at
124+
https://www.contributor-covenant.org/faq. Translations are available at
125+
https://www.contributor-covenant.org/translations.

LICENSE.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright @ 2023 Julian Pawlowski
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

README.md

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
<h1 align="center">
2+
<br>
3+
📩 A Template to host an MTA-STS Policy file on GitHub
4+
<br>
5+
</h1>
6+
7+
<h4 align="center">Use this template to host your <i>MTA Strict Transport Security (MTA-STS)</i> <a href="https://datatracker.ietf.org/doc/html/rfc8461">[RFC 8461]</a> policy file on GitHub Pages.</h4>
8+
9+
<p align="center">
10+
<a href="#how-to-use">How To Use</a> •
11+
<a href="#license">License</a> •
12+
<a href="#author">Author</a>
13+
</p>
14+
15+
MTA-STS is a security standard to secure e-mail delivery. E-mail servers that send inbound e-mail to your domain will be able to detect that your e-mail server supports SMTP-over-TLS via `STARTTLS` (also known as [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS)) before opening the actual connection.
16+
17+
In case the sending e-mail server is not able to initiate a secure connection, it will end the connection to enforce transport layer encryption. This mitigates [Man-in-the-middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) DNS and SMTP [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) that would allow an attacker to read or manipulate e-mail in transit.
18+
19+
## How To Use
20+
21+
1. Make sure you are [signed in to GitHub](https://github.com/login). Then click on [**Use this template**](https://github.com/jpawlowski/mta-sts.template/generate) to create a copy to your own GitHub profile (see [GitHub Docs](https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-a-repository-from-a-template)). Don't _clone_ the repository.
22+
You may name your repository whatever you like. For simplicity, you can name it `mta-sts.<your_domain.tld>`.
23+
24+
2. Change the file `.well-known/mta-sts.txt` according to your needs.
25+
26+
3. Create a `CNAME` record for `mta-sts.<your_domain.tld>` in your domain's DNS that points to `<you_username>.github.io` or `<your_organization>.github.io` and [enable GitHub Pages](https://docs.github.com/articles/using-a-custom-domain-with-github-pages/).
27+
28+
4. Open a browser to `https://mta-sts.<your_domain.tld>` and make sure it does not show any certificate warnings.
29+
30+
5. Create a `TXT` record for `_mta-sts.<your_domain.tld>` in your domain's DNS to enable the MTA-STS policy for your domain.
31+
You may copy & paste this to your DNS provider:
32+
33+
```dns
34+
#HOST #TTL #TYPE #VALUE
35+
_mta-sts 3600 TXT "v=STSv1; id=20220317000000Z"
36+
```
37+
38+
**Note that you will need to change the `id=` here whenever you make changes to your `mta-sts.txt` policy file.**
39+
40+
41+
6. Validate your setup, for example by using the [MTA-STS Lookup by MXToolBox](https://mxtoolbox.com/mta-sts.aspx), or looking into your [Hardenize Public Report](https://www.hardenize.com/).
42+
43+
*Optional (but __highly recommended__):*
44+
45+
7. Create another `TXT` record for `_smtp._tls.<your_domain.tld>` in your domain's DNS to enable reporting (see [RFC 8460](https://datatracker.ietf.org/doc/html/rfc8460)).
46+
You may copy & paste this to your DNS provider:
47+
48+
```dns
49+
#HOST #TTL #TYPE #VALUE
50+
_smtp._tls 3600 TXT "v=TLSRPTv1; rua=mailto:tls-rua@mailcheck.<your_domain.tld>"
51+
```
52+
53+
Note that the e-mail recipient mailbox shall be on a different domain _without_ MTA-STS being configured. This could be a subdomain like `mailcheck.<your_domain.tld>`.
54+
It is also quite painful to manually deal with the reports other e-mail providers will send to you. For that particular reason, you may want to consider sending these e-mails to a 3rd-party tool like [Report URI](https://report-uri.com/), [URIports](https://www.uriports.com/), or from other commercial providers.
55+
56+
You probably want this to be the same tool you might use for DMARC reports, like [DMARC Analyzer](https://www.dmarcanalyzer.com/) or [Dmarcian](https://dmarcian.com/).
57+
58+
## License
59+
60+
[MIT License](https://github.com/jpawlowski/mta-sts.template/blob/gh-pages/LICENSE)
61+
62+
## Author
63+
64+
[julian.pawlowski.me](https://julian.pawlowski.me/) &nbsp;&middot;&nbsp;
65+
GitHub [@jpawlowski](https://github.com/jpawlowski/mta-sts.template) &nbsp;&middot;&nbsp;
66+
Mastodon [@Loredo@chaos.social](https://chaos.social/@Loredo)

_config.yml

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: [".well-known"]

index.html

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<meta name="robots" content="noindex">
4+
<title>Redirecting to .well-known/mta-sts.txt</title>
5+
<meta http-equiv="refresh" content="0; URL=.well-known/mta-sts.txt">
6+
<link rel="canonical" href=".well-known/mta-sts.txt">

robots.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
User-agent: *
2+
Disallow: /

0 commit comments

Comments
 (0)