# DANE/GnuTLS
SERVER=
+CONTROL= *
.include DIR/aux-var/tls_conf_prefix
acl_smtp_rcpt = accept verify = recipient/callout
.endif
-log_selector = +received_recipients +tls_peerdn +tls_certificate_verified
+log_selector = +received_recipients +tls_peerdn +tls_certificate_verified \
+ +tls_sni
queue_run_in_order
driver = smtp
allow_localhost
port = PORT_D
+ hosts_try_fastopen = :
- hosts_try_dane = *
+ hosts_try_dane = CONTROL
hosts_require_dane = HOSTIPV4
tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
tls_try_verify_hosts = thishost.test.ex
- tls_verify_certificates = CDIR2/ca_chain.pem
+ tls_verify_certificates = ${if eq {DETAILS}{ca} {CDIR2/ca_chain.pem} {}}