3 ms·
What do you do when the mail server you're talking to (or its impersonator) doesn't offer startssl?
by tedunangst 5y ago
What do you do when the mail server you're talking to (or its impersonator) doesn't offer startssl?
- zokier 5y agoif the server does not have tls then mta-sts does not help much either? edit: I actually read the spec, and apparently the listing of allowed servers is a side aspect of the spec, the main meat is opting in to tls overall; that was not immediately obvious from the article. In that context your question makes more sense. To answer more comprehensively, I don't see why similar mechanism that functions well with HTTP would not work here; that the server would send STS policy to the client after connection which the client then caches and consults on subsequent connections. This is how HSTS works.
- tedunangst 5y agoI agree they could have added HAVESTS to the EHLO reply.