The mail server already uses a valid certificate.
We could add a TLSA record for the mail server in DNS, so that mailservers implementing DANE (that include all properly-configured Postfixes) require STARTTLS and a correct cert when connecting to mail.hashbang.sh.

The simplest solution would likely be to add a TLSA records that pin's GlobalSign's CA certificate, as this won't add overhead while renewing the cert, yet provides a notable increase in security.

We should follow DMARC for incoming mail, meaning:

• checking SPF;
• checking DKIM;
• applying the DMARC policy (none/quarantine/reject and reporting).

Presumably, no local domain can be used in an alias defined in a file.

Unclear whether it is a Postfix config issue, or a Docker issue.

Manifests as very long timeouts whenever users send mail, as the connection on IPv6 must timeout first.

So who's going to write the spoof mail server to get this tested? :P

We should sign outgoing mail using DKIM.

This involves:

• implementing DKIM proper;
• adapting our DMARC policy in DNS.