On 26 Aug 2020, at 12:50, Scott Mutter via mailop wrote:
How many mail operators out there are forcing outbound SMTP
communications
to use TLS? Is this a common practice now?
It is very uncommon.
I know secure everything and
TLS everywhere is a popular movement at this moment.
It certainly gets a lot of talk...
I've noticed that Constant Contact (constantcontact.com - at least the
mail
server at 205.207.104.108) and yahoo.co.jp (67.195.204.74) don't
appear to
be accepting STARTTLS. Is that strange?
Strange, but only because they are relatively big names. There's still a
lot of insecurity in the long tail.
[...]
I've been toying with the idea of forcing outbound SMTP connections to
use
TLS, but thought I'd take a quick look and see who might miss mail if
this
done. It looks like most mail servers handle TLS, I haven't extended
this
test to a lot of servers yet so it may just be that the mail servers I
have
enacted this on are small volume senders.
You can get away with it if you do not have substantial volume and
diversity in where you send mail to.
For example, it has been >6 months since my personal mail server has
sent out a message not using TLS. However, that's just a couple hundred
messages sent to a few dozen distinct mail systems. One of the systems I
help administer handles about that volume daily, with about the same
diversity, but it send in the clear multiple times per day because of a
handful of specific business relationships between our customers and
companies that happen to run shoddy mail systems. To this day there are
still mail servers sitting behind firewalls that break TLS (e.g.
PIX/ASA.)
I should note, forcing TLS is different from preferring TLS. I think
a lot
of MTAs (at least Exim, I think?) prefer TLS and will attempt to
negotiate
a STARTTLS session, but if that fails, then it will continue without
TLS.
By forcing TLS, I'm telling my server to close the connection if a
STARTTLS
session can't be started. Are any other mail server admins doing
this? Or
is it still too early to require this?
Too early for any mail system with diverse users who have normal service
level expectations, unless you carefully examine your actual mail
stream and determine that none of your users routinely send mail to
companies using poorly-administered mail servers or Cisco firewalls.
--
Bill Cole
[email protected] or [email protected]
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not For Hire (currently)
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
