7 ms·
DNSSEC is useful for SMTP SSL encryption (at least from you to your server). https://blog.filippo.io/the-sad-state-of-smtp-encryption/ https://blog.filippo.io/
by totony 11y ago
DNSSEC is useful for SMTP SSL encryption (at least from you to your server).
https://blog.filippo.io/the-sad-state-of-smtp-encryption/ https://blog.filippo.io/the-sad-state-of-smtp-encryption/
- tptacek 11y agoNope! They fixed that: there's now SMTP Strict Transport Security, sponsored by Google, Microsoft, and Yahoo. SMTP STS explicitly does not require DNSSEC --- because nobody thinks at-scale DNSSEC is going to happen anymore.
- totony 11y agoIsn't this still a draft? Also, it does not fix MX record spoofing, only downgrade attacks IIRC? EDIT: Just reviewed the draft, seems like it addresses MX spoofing, but it seems to do it either via HTTPS or DNSSEC, so DNSSEC seems to be used by it
- tptacek 11y agoWhat does "still a draft" mean? That a bunch of randos at IETF haven't approved it yet? Three of the most important email providers on the planet sponsored it. It's what's going to happen.
- totony 11y agoIt means it's not implemented in most SMTP clients/SMTP servers. The randos have a huge impact. Not everyone uses Gmail/Outlook