Support anonymous certificates. With DANE they may be just public-key containers.
Cosmetic: inconsistent log format
Support for DNSSEC-validated lookups and TLSA RRsets.
Preliminary DANE support: per-destination trust-anchor digests.

Refactored internal verification callback machinery and re-implemented
fingerprint support via the new dane digest engine.

What remains now is to refactor smtp(8) to actually do DANE lookups
and build the appropriate policy structures on the fly.
Polish docs for smtp_tls_trust_anchor_digests
Bugfix: preserve the default state of RES_USE_EDNS0.

We turn it on before DNSSEC, and restore it after, but otherwise leave
it alone.
whitespace in dns_lookup.c
Remove some premature DANE security level support.
Transplant tls_dane_match() unchanged back to tls_verify.c.

This makes verify callback clients not depend on the rest of the
DANE module and soon libdns.  This is a better home for it anyway.
New module for computing various digests and encoding fingerprints. Cut/paste from tls_dane.c.

Only real change is rename of tls_dane_serverid() to tls_serverid_digest().
Export functions to digest and fingerprint encode.

These will be needed to convert DANE digests from wire format.
Documentation cleanup.

Hyperlink postconf.proto TLS security levels to TLS_README.html
Cosmetic TLS_README.html cleanup
Fill in some missing postlink lmtp shadow parameters
Make parameter name reporting consistent in smtp+lmtp.

The smtp+lmtp delivery agent chooses its parameter personality (lmtp
or smtp) early in main() by looking at the tail of argv[0].

Later in smtp_state_alloc() it compared var_procname with "smtp"
and "lmtp" and again chose the same personality setting a flag in
the state structure.  This separate check creates an small opportunity
for inconsistent behaviour.  We make the original choice in main a
global variable, and make sure that var_procname in smtp_state_alloc()
is consistent with the initial choice.

The real motivation is however that in many cases the logging of
parameter names reported only the smtp(8) version of the parameter.
A couple of macros that test the new global "smtp_mode" made parameter
name logging consistent and much less tedious.
Replace disable_dns_lookups with backwards-compatible smtp_dns_support_level.

The new parameter can be empty (compatible) or else one of "disabled",
"enabled" or (if libresolv include files cooperate) "dnssec".

Plus documentation, and integration into the SMTP delivery agent:

    - When the level is "dnssec" enable DNSSEC lookups for MX records
      and any securely known hostnames.
    - When hostnames are securely validated, use the resolved hostname
      to name the SMTP session and to control TLS policy.
    - Pass the DNSSEC validation flag to smtp_session_alloc().

Related change to tls_dane.c to document tls_dane_avail() and make
it dependent on the required libresolv features.
Split off session TLS policy parameters to a new structure.

We add a pointer to an SMTP_TLS_SESS to SMTP_SESSION to replace the
bunch of directly stored TLS parameters.

The SMTP_TLS_SESS structure is managed by a new module (which behaves
identically, after this commit, apart from the indirection).

This simplifies upcoming work.
Allow smtp_session_alloc() to fail gracefully and report an error.

With DANE TLS lookups contributing to TLS policy lookups DNS lookup
errors make this much more likely, so we need to return an suitable
DSN error structure from smtp_tls_sess_alloc() via smtp_session_alloc().
Add ctable_refresh.

Applications that store TTLs in the cached values can request that
a stale entry to flushed and a new one fetched.
Documentation of new DANE level and new parameters.
Implemented and enabled DANE security level.
New utility function for clock-wrap safe time comparison.

Perhaps someone will still be using a 32-bit system in 2038.