X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/09c17790eec23907b93df1ec7cee746b28dfc836..3c71915d2f4f00f7e159808c70ae2513f03b7be4:/doc/doc-txt/experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 266e19891..4a2a04bb4 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -821,7 +821,7 @@ The following variables are likely to be useful depending on the event type:
 
 An example might look like:
 
-event_action = ${if = {msg:delivery}{$event_name} \
+event_action = ${if eq {msg:delivery}{$event_name} \
 {${lookup pgsql {SELECT * FROM record_Delivery( \
     '${quote_pgsql:$sender_address_domain}',\
     '${quote_pgsql:${lc:$sender_address_local_part}}', \
@@ -1154,14 +1154,17 @@ support to date has not made these checks.
 
 If built with EXPERIMENTAL_CERTNAMES defined, code is
 included to do so for server certificates, and a new smtp transport option
-"tls_verify_cert_hostnames" supported which takes a list of
-names for which the additional checks must be made.
+"tls_verify_cert_hostnames" supported which takes a hostlist
+which must match the target host for the additional checks must be made.
 The option currently defaults to empty, but this may change in
 the future.  "*" is probably a suitable value.
 Whether certificate verification is done at all, and the result of
 it failing, is stll under the control of "tls_verify_hosts" nad
 "tls_try_verify_hosts".
 
+The name being checked is that for the host, generally
+the result of an MX lookup.
+
 Both Subject and Subject-Alternate-Name certificate fields
 are supported, as are wildcard certificates (limited to
 a single wildcard being the initial component of a 3-or-more
@@ -1170,7 +1173,7 @@ component FQDN).
 The equivalent check on the server for client certificates is not
 implemented.  At least one major email provider is using a client
 certificate which fails this check.  They do not retry either without
-hte client certificate or in clear.
+the client certificate or in clear.
 
 It is possible to duplicate the effect of this checking by
 creative use of Events.
@@ -1299,12 +1302,13 @@ MX, A and TLSA records.
 
 A TLSA lookup will be done if either of the above options match
 and the host-lookup succeded using dnssec.
-If the TLSA lookup succeeds, a TLS connection will be required
-for the host.
+If a TLSA lookup is done and succeeds, a DANE-verified TLS connection
+will be required for the host.
 
 (TODO: specify when fallback happens vs. when the host is not used)
 
-If dane is in use the following transport options are ignored:
+If DANE is requested and useable (see above) the following transport
+options are ignored:
   hosts_require_tls
   tls_verify_hosts
   tls_try_verify_hosts
@@ -1312,6 +1316,10 @@ If dane is in use the following transport options are ignored:
   tls_crl
   tls_verify_cert_hostnames
 
+If DANE is not usable, whether requested or not, and CA-anchored
+verification evaluation is wanted, the above variables should be set
+appropriately.
+
 Currently dnssec_request_domains must be active (need to think about that)
 and dnssec_require_domains is ignored.