Topic: Forward Secrecy

[Daniel B.]

Ok, didn't know that. Still, it'd have continued if the CN didn't match I guess, but you'd have a log trace at least

[Knuddi]

If the destination domain (or mail server) has a DANE record (TLSA record) and the key there does not match the presented key when connecting, the sending server should not continue. But very very few domain advertise this TLSA key (yet) and hence as of now its not super effective.