version: STSv1
mode: enforce
mx: mail1.yourdomain.com
mx: mail2.yourdomain.com
mx: *.yourdomain.com
max_age: 604800

# 1. MTA-STS Policy Discovery Record
# Indicates to sending MTAs that a policy exists and specifies the policy revision ID
_mta-sts.yourdomain.com.    300  IN  TXT  "v=STSv1; id=20261021T1200Z;"

# 2. TLS-RPT Diagnostic Reporting Record
# Instructs sending MTAs where to submit daily aggregate JSON reports of TLS failures
_smtp._tls.yourdomain.com.  300  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-rpt@yourdomain.com,https://api.yourdomain.com/v1/tls-reports"

# ==============================================================================
# ENTERPRISE OUTBOUND TLS & CIPHER HARDENING
# ==============================================================================

# Enable STARTTLS negotiation on all outbound connections
use-starttls yes

# Specify trusted CA bundle for validating remote MX certificates
smtp-ssl-ca-file /etc/pki/tls/certs/ca-bundle.crt

# Enforce TLS 1.2 and TLS 1.3 exclusively (disable vulnerable SSLv2, SSLv3, TLS 1.0, TLS 1.1)
ssl-protocols TLSv1.2, TLSv1.3

# High-strength PFS (Perfect Forward Secrecy) cipher suite string
ssl-cipher-list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

# Strict TLS Enforcement for Major Mailbox Providers
<domain gmail.com>
    use-starttls yes
    require-starttls yes
    smtp-ssl-certificate-verification yes
</domain>

<domain yahoo.com>
    use-starttls yes
    require-starttls yes
    smtp-ssl-certificate-verification yes
</domain>

<domain *.outlook.com>
    use-starttls yes
    require-starttls yes
    smtp-ssl-certificate-verification yes
</domain>

# Fallback for general domains with automatic backoff on TLS failures
<domain *>
    use-starttls yes
    require-starttls no
    smtp-ssl-certificate-verification no
    retry-after-tls-failure 10m
</domain>

import gzip
import json
import email
import sys

def parse_tls_report(raw_email_path):
    with open(raw_email_path, 'r', encoding='utf-8', errors='ignore') as f:
        msg = email.message_from_file(f)
        
    for part in msg.walk():
        content_type = part.get_content_type()
        filename = part.get_filename() or ""
        
        # Look for gzip or json report attachment
        if "gzip" in content_type or filename.endswith('.gz'):
            payload = part.get_payload(decode=True)
            decompressed = gzip.decompress(payload)
            data = json.loads(decompressed.decode('utf-8'))
            
            org = data.get('organization-name')
            date_range = data.get('date-range', {})
            policies = data.get('policies', [])
            
            print("=== TLS REPORT FROM " + str(org) + " ===")
            print("Start: " + str(date_range.get('start-datetime')) + " | End: " + str(date_range.get('end-datetime')))
            
            for p in policies:
                pol = p.get('policy', dict())
                summary = p.get('summary', dict())
                print("Domain: " + str(pol.get('domain')) + " | Mode: " + str(pol.get('policy-type')))
                print("  Success count: " + str(summary.get('total-successful-session-count')))
                print("  Failure count: " + str(summary.get('total-failure-session-count')))
                
                # Check specific failure details
                failures = p.get('failure-details', list())
                for fail in failures:
                    print("  [ERROR] Type: " + str(fail.get('result-type')) + " | IP: " + str(fail.get('receiving-ip')))

if __name__ == "__main__":
    if len(sys.argv) > 1:
        parse_tls_report(sys.argv[1])