design: upstream-tls-verify - a Verified TLS mode to the upstream

Owner, 2026-10-18: "Оба предложения делаем" (the roadmap's
upstream-tls-verify, from the security audit's M7). The upstream's TLS
select gets a fourth choice between Required and Off: Verified, which also
checks the upstream's certificate - issued by a trusted authority for the
host given, so the host is given by name. A help line under the select
says how Required and Verified differ; the domain's lead says "over
verified TLS"; the list's TLS tag "verified" (green, as required);
Help's Upstream topic describes Verified and when the mail waits.
check.py: 0 violations; outlines unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-18 10:07:51 +03:00
co-authored by Claude Opus 5.5
parent 554e007f22
commit c10cd78eff
6 changed files with 10 additions and 8 deletions
@@ -91,7 +91,7 @@
<div class="table-container"><table class="table is-fullwidth is-hoverable">
<thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS to upstream</th><th></th></tr></thead>
<tbody>
<tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">required</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
<tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">verified</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
<tr><td><a href="in-domain.html"><strong>acme.io</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">10.0.4.12:2525</td><td>any address</td><td><span class="tag is-light">opportunistic</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
</tbody>
</table></div>