If someone is sending a SMTP email inbound using TLS and presenting a certificate - record the certificate fingerprint in the log file and also put it in the email transport header. With this "trick" emails more traceable if you know the sender name, certificate, and fingerprint.

Example:

If user@domian.com is sending me an email and the certificate belongs to domain.com and is trusted and I have the fingerprint in the header ... I can be pretty sure that its actually that user that sent it

by: Mike B. | over a year ago | Agents