I made a tool for automatically updating the current and next (rollover) TLSA DNS records with acme.sh and the Cloudflare API reddit / selfhosted ---------------------------------------------------------------------- Nixigaj · 2023-12-10 23:34 For the few people here that happen to run a self-hosted email server with [acme.sh](https://github.com/acmesh-official/acme.sh) for TLS key/cert generation and Cloudflare for DNS management, I have made a tool that i personally use to get a perfect 100% score on [Internet.nl's email test](https://internet.nl/test-mail/). While acme.sh can automatically renew the TLS certificates themselves [and also generate the next (rollover) key](https://github.com/acmesh- official/acme.sh/issues/3096), it does not have any solution for automatically updating TLSA DNS records useful for [DANE authentication](https://en.wikipedia.org/wiki/DNS- based_Authentication_of_Named_Entities) with email servers. As I happen to use Cloudflare for DNS management of my domain, I can use their API for manipulating the DNS records. It is written in Go and the [GitHub repo is here](https://github.com/nixigaj/cf-tlsa-acmesh). It includes instructions about installing and setting up the tool, and it *should probably* also be compatible with any other tools that can generate current and next EC private keys. Oh yeah, and my deliverability game is still going strong since my [last post about self-hosted email](https://www.reddit.com/r/selfhoste d/comments/11heogd/haters_will_say_its_fake/). ---------------------------------------------------------------------- zfa · 2023-12-11 06:28 What's current best practice for this? Years back when I looked at it and set up my tooling, LE recommended TLSA records with usage=3, selector=0, matching=1. ---------------------------------------------------------------------- olen0 · 2023-12-11 15:57 Are you still using Maddy? ---------------------------------------------------------------------- Nixigaj · 2023-12-11 19:13 Yes, still using Maddy + Dovecot + Rspamd and everything works fine, but I've been thinking about trying out [https://stalw.art/](https://stalw.art/) to be able to try out the new JMAP protocol that is intended to replace IMAP.