Mutual TLS for Email Authentication

Valid client and server TLS certificates authenticate the traffic coming from the SMTP sending and receiving servers. Domain owners can delegate email sending and receiving to servers using Mail eXchange (MX) DNS resource records. This enables transitive authentication of mail traffic from sending and receiving domains of envelope sender much like Sender Policy Framework and the envelope recipient. This document also proposes an Automatic Certificate Management Environment responder using these DNS records to automate TLS certificate issuance.