I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain

  • MartianSands@sh.itjust.works
    16·
    9 days ago

    your certificate request must come from an authorized email address at bank.com

    That isn’t true in general. In fact, it can’t be.

    It might be policy for most cases from the well-known certificate authorities, but it’s not part of the protocol or anything like that.

    If it were, then it would be impossible to set up your mailserver to begin with because you could never get a certificate for mail.bank.com

    • Ghoelian@lemmy.dbzer0.com
      8·
      9 days ago

      Yeah, letsencrypt doesn’t do this for example. They do ask for an email address, but that’s just for expiry notices.

      They do require you control the domain, and run it on the server the DNS record points to. When using certbot at least.

        • chameleon@fedia.io
          2·
          9 days ago

          The email ecosystem is changing in recent years but yeah, it’s best to expect that there is at least one opportunity for any given email to be sent over the internet unencrypted. MTA-STS has been slowly changing the landscape but adoption isn’t going all that great.