On 1/27/16 9:16 AM, Juliusz Chroboczek wrote: >> http://the-edge.taht.net/post/starttls_considered_helpful/ > > Did you bounce mail when the first MX contacted didn't do STARTTLS, or did > you bounce when none of the MXes for a domain supported it? In other > words, did you treat lack of STARTTLS as a transient or permanent error?
Postfix when set to encrypt always treats lack of TLS support on the other exchanger(s) as a transient error, and retries by default for 3 days. Example: Jan 27 17:16:11 mail postfix/smtp[10770]: 801CD21331: to=<[email protected]>, relay=brevard.conman.org[elided]:25, delay=67644, delays=67640/0.01/4/0, dsn =4.7.4, status=deferred (TLS is required, but was not offered by host brevard.conman.org[elided]) So this made it safer to temporarily make it mandatory, do email for a few hours, get who failed out of my logs, craft the email to those failing, then relax the defaults for starttls back to "may". google reports that 82% of their outbound email and only 58% of their inbound email is covered by starttls, and there are distinct regional differences... notably, free.fr in your region is not using starttls on inbound at all, it seems. Ton of data at: https://www.google.com/transparencyreport/saferemail/ And sadly, the growth curve for uptake in the past year appears flat. _______________________________________________ Bloat mailing list [email protected] https://lists.bufferbloat.net/listinfo/bloat
