4 ms·
I'm OK with StartTLS. What I think is missing is a DNS record that mail servers cache for a long time, similar to HSTS that says you MUST use encryption for th
by LinuxBender 5y ago
I'm OK with StartTLS. What I think is missing is a DNS record that mail servers cache for a long time, similar to HSTS that says you MUST use encryption for this domain. Probably also a variation to the record to say to validate the cert chain. This would align with an existing capability in postfix that allows you to specify which domains must be encrypted, or mandatory cert chain validation and to what level. At least I think this would be the easiest path to a better security stance and probably the simplest to implement given the myriad of email servers, clients and client libraries. Perfect is the enemy of good, or so they say. Below is from postfix. There are many more options.
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
example.net secure match=example.net:.example.net
anotherexample.net may match=anotherexample.com:.anotherexample.com
- gnabgib 5y agoIt sounds like you're asking for [MTA-STS](https://dmarcian.com/mta-sts/ https://dmarcian.com/mta-sts/) "MTA-STS is an inbound mail protocol designed to add a layer of encryption/security between sending and receiving mail servers."(..) "The MTA-STS protocol works by having a DNS record that tells mail servers to fetch a policy file via HTTPS from a defined subdomain. This file contains a list of the receiver’s mail servers which are authenticated and approved to receive the messages and also what policy to apply to inbound messages."
- LinuxBender 5y agoMaybe. Any time we ask a library or client to do HTTP fetches when it historically only did SMTP I become less optimistic about adoption. There are obvious easy wins like Thunderbird and Outlook and those could potentially use a plugin or add-on. Maybe that could be a good start and good enough.