3 ms·

MTA-STS only helps when the providers on both end use it. This post doesn't seem to say: will there be anything in the interface to indicate whether a message t

MTA-STS only helps when the providers on both end use it. This post doesn't seem to say: will there be anything in the interface to indicate whether a message transmitted via MTA-STS or not?

pwinnski 8y ago
Answering my own question: For messages sent today from a Google Apps account to a gmail account, I see that instead of "mailed-by: <domain>", there are now two new headers: "signed-by: <hostname>" and "security: Standard encryption (TLS)" with a link to learn more. This seems to be about S/MIME support, not MTA-STS support.
- jcranmer 8y ago
  In general, with email headers, you cannot trust any of them. The one exception is the Received header added by your MTA, and perhaps other headers if you know your MTA adds them and you know that it will strip any that appear in the original message.
  - shereadsthenews 8y ago
    You can verify the authenticity of any header that appears in the DKIM signature. That's why you see things like this in the signature: h=mime-version:from:date:message-id:subject:to:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :list-post:list-help:list-archive:list-unsubscribe:list-subscribe;
tptacek 8y ago
If I understand your question (I might not): MTA-STS works the same way HTTPS-STS works: you cache the lookup result and remember it for future transactions. This is a pretty powerful feature in HTTPS (it more or less breaks "SSL stripping" without requiring users to actually do anything), and the relationships between MTAs are far more stable than those between browsers and web servers, so you'd expect the potency of STS to be proportionally improved. If you're asking more generally about who's going to adopt STS, the RFC was cosponsored by essentially all the major mail providers. This is likely to be a universal standard in the coming years.
- pwinnski 8y ago
  I was thinking more about how it would be indicated in headers (or the interface), but yes, you've helped me understand this better. Thank you.
shereadsthenews 8y ago
A message isn't "transmitted with" MTA-STS. MTA-STS allows you to publish policies that others consume when sending and receiving mail. If you are concerned that your mail to or from your gsuite domain might be sent without TLS encryption and authentication you can require TLS in your admin console. Traffic without TLS will bounce at the SMTP boundary of Gmail.
LeonM 8y ago
A message is not 'transmitted via MTA-STS', it is transmitted via SMTP that uses TLS (SSL) to secure the connection between mailservers. MTA-STS [0] is a method to publish a policy on whether email servers (known as Mail Transfer Agents, or MTA's) are allowed to use insecure (non-TLS) connections for email from your domain. MTA-STS is needed because the system to deliver email over the internet (SMTP) has a fallback method where it will switch to an unencrypted connection if the encrypted connection fails for some reason. By blocking a encrypted connection in the middle, an attacker can force a mailserver to fall-back to a non-encrypted connection. This way the attacker can intercept the message in transit. This is known as a downgrade attack. Some governments are known for doing this. So, MTA-STS prevents downgrade attacks (to a certain extend, because the MTA's that your email passes through must support it). There is also a new proposed standard called TLS-RPT [1] that allows for reporting the usage of TLS, so you know if your MTA-STS policy caused an email delivery to fail. At Mailhardener [2] we are working on hosted MTA-STS and TLS-RPT integration (both features are still in closed beta for now). It's great to see Gmail adopting MTA-STS, as this will accelerate adoption globally. [0] https://tools.ietf.org/html/rfc8461 https://tools.ietf.org/html/rfc8461 [1] https://tools.ietf.org/html/rfc8460 https://tools.ietf.org/html/rfc8460 [2] https://www.mailhardener.com https://www.mailhardener.com
- tptacek 8y ago
  It's great and unsurprising to see them adopting MTA-STS, since their name is on the RFC.
- josteink 8y ago
  > MTA-STS is needed because the system to deliver email over the internet (SMTP) has a fallback method where it will switch to an unencrypted connection if the encrypted connection fails for some reason. I couldn’t possibly see any simpler way to solve this very basic problem. /sarcasm

MTA-STS only helps when the providers on both end use it. This post doesn't seem to say: will there be anything in the interface to indicate whether a message transmitted via MTA-STS or not?

pwinnski 8y ago

Answering my own question: For messages sent today from a Google Apps account to a gmail account, I see that instead of "mailed-by: <domain>", there are now two new headers: "signed-by: <hostname>" and "security: Standard encryption (TLS)" with a link to learn more. This seems to be about S/MIME support, not MTA-STS support.

jcranmer 8y ago
In general, with email headers, you cannot trust any of them. The one exception is the Received header added by your MTA, and perhaps other headers if you know your MTA adds them and you know that it will strip any that appear in the original message.
- shereadsthenews 8y ago
  You can verify the authenticity of any header that appears in the DKIM signature. That's why you see things like this in the signature: h=mime-version:from:date:message-id:subject:to:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :list-post:list-help:list-archive:list-unsubscribe:list-subscribe;

tptacek 8y ago

If I understand your question (I might not): MTA-STS works the same way HTTPS-STS works: you cache the lookup result and remember it for future transactions. This is a pretty powerful feature in HTTPS (it more or less breaks "SSL stripping" without requiring users to actually do anything), and the relationships between MTAs are far more stable than those between browsers and web servers, so you'd expect the potency of STS to be proportionally improved. If you're asking more generally about who's going to adopt STS, the RFC was cosponsored by essentially all the major mail providers. This is likely to be a universal standard in the coming years.

pwinnski 8y ago
I was thinking more about how it would be indicated in headers (or the interface), but yes, you've helped me understand this better. Thank you.

shereadsthenews 8y ago

A message isn't "transmitted with" MTA-STS. MTA-STS allows you to publish policies that others consume when sending and receiving mail. If you are concerned that your mail to or from your gsuite domain might be sent without TLS encryption and authentication you can require TLS in your admin console. Traffic without TLS will bounce at the SMTP boundary of Gmail.

LeonM 8y ago

A message is not 'transmitted via MTA-STS', it is transmitted via SMTP that uses TLS (SSL) to secure the connection between mailservers. MTA-STS [0] is a method to publish a policy on whether email servers (known as Mail Transfer Agents, or MTA's) are allowed to use insecure (non-TLS) connections for email from your domain. MTA-STS is needed because the system to deliver email over the internet (SMTP) has a fallback method where it will switch to an unencrypted connection if the encrypted connection fails for some reason. By blocking a encrypted connection in the middle, an attacker can force a mailserver to fall-back to a non-encrypted connection. This way the attacker can intercept the message in transit. This is known as a downgrade attack. Some governments are known for doing this. So, MTA-STS prevents downgrade attacks (to a certain extend, because the MTA's that your email passes through must support it). There is also a new proposed standard called TLS-RPT [1] that allows for reporting the usage of TLS, so you know if your MTA-STS policy caused an email delivery to fail. At Mailhardener [2] we are working on hosted MTA-STS and TLS-RPT integration (both features are still in closed beta for now). It's great to see Gmail adopting MTA-STS, as this will accelerate adoption globally. [0] https://tools.ietf.org/html/rfc8461 https://tools.ietf.org/html/rfc8461 [1] https://tools.ietf.org/html/rfc8460 https://tools.ietf.org/html/rfc8460 [2] https://www.mailhardener.com https://www.mailhardener.com

tptacek 8y ago
It's great and unsurprising to see them adopting MTA-STS, since their name is on the RFC.
josteink 8y ago
> MTA-STS is needed because the system to deliver email over the internet (SMTP) has a fallback method where it will switch to an unencrypted connection if the encrypted connection fails for some reason. I couldn’t possibly see any simpler way to solve this very basic problem. /sarcasm