upstream-tls-verify: Verified TLS to an inbound domain's upstream

Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.

- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
  0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
  written to the TLS policy map like the others. Postfix matches the
  certificate against the next hop's name (smtp_tls_secure_cert_match =
  nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
  for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
  (smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
  "", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
  verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
  "over verified TLS", the list's tag "verified"; Help word for word with
  the mockup; guide § Inbound relay, with a posttls-finger command to try
  an upstream first.

Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/inbound/service.go

@@ -108,6 +108,9 @@ func (s *Service) SetTransportAs(id int64, host, portRaw, tlsMode string, mayCha
 	if err := checkTLSMode(tlsMode); err != nil {
 		return 0, err
 	}
+	if err := checkSecureHost(host, tlsMode); err != nil {
+		return 0, err
+	}
 	domains, err := s.store.ListInboundDomains()
 	if err != nil {
 		return 0, err

internal/inbound/service_test.go

@@ -2,6 +2,7 @@ package inbound
 
 import (
 	"errors"
+	"strings"
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/postfix"
@@ -66,3 +67,28 @@ func TestOneTLSModePerUpstream(t *testing.T) {
 		t.Errorf("the refused save changed something: c on %d, a %s", d.Port, mode(a.ID))
 	}
 }
+
+// Verified TLS (secure) is saved for an upstream given by name and refused for
+// one given by address: Postfix checks the certificate against the next hop's
+// name (upstream-tls-verify).
+func TestVerifiedTLSNeedsTheUpstreamsName(t *testing.T) {
+	st, err := store.Open(t.TempDir() + "/test.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	s := NewService(st, nullMaps{})
+	d, _ := s.Add("in.example")
+	for _, host := range []string{"10.0.0.8", "[2001:db8::25]"} {
+		var v *ValidationError
+		if err := s.SetTransport(d.ID, host, "25", store.TLSModeSecure); !errors.As(err, &v) || !strings.Contains(err.Error(), "give the upstream by name") {
+			t.Errorf("Verified TLS to %s: %v, want refused", host, err)
+		}
+	}
+	if err := s.SetTransport(d.ID, "MX.Example.NET", "25", store.TLSModeSecure); err != nil {
+		t.Fatalf("Verified TLS to a name: %v", err)
+	}
+	if got, _ := st.GetInboundDomain(d.ID); got.TLSMode != store.TLSModeSecure || got.Host != "mx.example.net" {
+		t.Errorf("saved %s %s", got.Host, got.TLSMode)
+	}
+}

internal/inbound/validate.go

@@ -103,13 +103,26 @@ func parsePort(raw string) (int, error) {
 
 func checkTLSMode(mode string) error {
 	switch mode {
-	case "may", "encrypt", "none":
+	case "may", "encrypt", "secure", "none":
 		return nil
 	default:
 		return invalid("invalid TLS mode")
 	}
 }
 
+// checkSecureHost refuses Verified TLS for an upstream given by address:
+// Postfix's secure level matches the certificate against the next hop's name
+// (smtp_tls_secure_cert_match = nexthop, dot-nexthop; Postfix 3.10.13,
+// postconf(5): "the transport next-hop configured for the domain stripped of
+// ... enclosing square brackets and trailing port"), and a certificate names
+// hosts, not addresses.
+func checkSecureHost(host, mode string) error {
+	if mode == "secure" && net.ParseIP(host) != nil {
+		return invalid("Verified TLS checks the upstream's certificate against its name: give the upstream by name, not by address")
+	}
+	return nil
+}
+
 func checkRecipientMode(mode string) error {
 	switch mode {
 	case "list", "any":