3 ms·
Awhile back I started requiring TLS for connections to my mail server. Not only is this not standards compliant from what I recall, but I've noticed a disturbin
by rascul 11y ago
Awhile back I started requiring TLS for connections to my mail server. Not only is this not standards compliant from what I recall, but I've noticed a disturbing amount of other mail servers that apparently require plaintext connections. Most notable is password and college application information which couldn't be delivered to me because their mail servers refused to use TLS. The college in question was kind enough to look at their logs for me and see the issue, and ask me to disable TLS to receive the information. Of course this doesn't solve all the problems. Mail is still stored in plaintext, at least until I figure out a workable solution for that, and there's probably still the possibility of MITM attacks, but I feel at least requiring TLS is a step in the right direction. Until email is finally abolished, anyway.
- ndespres 11y agoYou set yourself up to miss a fair bit of email that way. Most mail servers I work with use "opportunistic TLS": attempt TLS for outgoing mail; accept if offered for incoming mail; selectively enforce TLS on a per-domain basis for confidential communication to partner banks, law firms, financial firms. Enforce TLS on your mail server and you're siloing yourself from a large part of the internet, and unless you're Gmail and your actions carry weight, others will simply stop emailing you after their mail keeps bouncing.
- rascul 11y agoIndeed. It's my personal mail server, and I hate email enough so that receiving less email (for whatever reason) is not usually a concern of mine. More important than my dislike of email is organizations which refuse to send sensitive data over anything but plaintext.