Ten Policies That Were Really One

This account was drafted on 19 August 2026. Operational states, versions and test results describe that period unless a later update is explicitly dated.

Ten MTA-STS hostnames appeared to serve ten policies. They did not.

Before promoting blue-canoe.net from testing to enforcement, we checked the live Nginx configuration rather than assuming that separate hostnames implied separate state. All ten virtual hosts pointed through an alias to one shared policy file.

Changing that file to enforce would have changed every hosted domain at once.

Ten front doors, one room

From the outside the arrangement looked properly separated. Each domain had its own mta-sts hostname, HTTPS certificate and DNS discovery record. The coupling lived behind those interfaces in one filesystem path.

That distinction matters because the domains were not at the same operational stage. blue-canoe.net had DNSSEC, known MX identities, direct certificate validation and TLS-RPT evidence supporting enforcement. The other nine were supposed to remain in testing until their own evidence justified a change.

Inspection before mutation

The defect was found because the change process began by tracing the live path from hostname to virtual host to alias to file. Had we started with the apparently obvious edit, the first evidence of the coupling might have been ten changed public policies.

This is why I separate preflight from apply. A preflight is not merely a syntax check. It establishes what an operation will actually touch.

Repair the structure before changing the state

The migration created one policy directory and file per domain. All ten active configurations were backed up before the first change. Nginx configuration was tested, reloaded once, and every policy was fetched over local HTTPS and checksummed. Automatic rollback covered unexpected configuration failures.

After migration, no active virtual host served the original shared file. blue-canoe.net could then move to enforce without dragging the other nine domains with it.

Identical is not the same as shared

After the split, the nine testing policies had identical contents and therefore identical SHA-256 hashes. That is expected. They all name the same three MX hosts and use the same one-day lifetime. Their independence comes from separate backing paths and management state, not from manufacturing textual differences for appearance's sake.

This is a useful infrastructure lesson beyond MTA-STS. Ten interfaces do not necessarily mean ten independently controllable objects. Sometimes they are ten labels on one switch.

Enforcement remained a per-domain decision

Only blue-canoe.net was promoted. At that stage, the other nine remained publicly discoverable in testing. That is not unfinished bulk work waiting for one large command; it is a set of separate decisions requiring separate evidence.

The important correction was not changing a policy from testing to enforce. It was making sure that one domain could change without lying about what would happen to the other nine.