4 ms·

I wonder what the uptake of MTA-STS is. Does anyone collect stats on this?

8organicbits 2y ago
I was poking around recently. Adoption appears very low on a per-domain basis [1], but high-volume mail providers like Gmail support it. Relatedly, DNSSEC adoption (and presumably DANE) is finally decreasing. So MTA-STS looks like the path forward. Lots of folks have been predicting this. [2] [1] https://www.uriports.com/blog/mta-sts-survey-2024/ https://www.uriports.com/blog/mta-sts-survey-2024/ [2] https://www.verisign.com/en_US/company-information/verisign-labs/internet-security-tools/dnssec-scoreboard/index.xhtml https://www.verisign.com/en_US/company-information/verisign-...
Avamander 2y ago
It's quite a bit more accessible than DANE, so uptake has increased in the last few years. A bunch of high-volume operators support it, like gmail. But support also exists in newer MTA software like Stalwart, Maddy and ZoneMTA. (Though there are ways to add MTA-STS support to Postfix as well.) MTA-STS has a great benefit that one doesn't need to deal with the antiquities of their registrars or TLD operators, just set up a few records and run a web server. WebPKI in general is also significantly better than DNSSEC. So you win twice. Though MTA-STS doesn't cover the part between MUA and MSA unfortunately, I've seen an abandoned draft for MUA-STS but that's about it.
- newman314 2y ago
  You can actually run MTA-STS on Cloudflare Workers so the web server piece isn't even necessary. It was fairly easy to implement and works well for me.
upofadown 2y ago
Exim doesn't support MTA-STS[1] although there is a perl script available[2]. [1] https://www.exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp_connections_using_tlsssl.html https://www.exim.org/exim-html-current/doc/html/spec_html/ch... [2] https://github.com/Bobberty/MTASTS-EXIM-PERL https://github.com/Bobberty/MTASTS-EXIM-PERL

I was poking around recently. Adoption appears very low on a per-domain basis [1], but high-volume mail providers like Gmail support it. Relatedly, DNSSEC adoption (and presumably DANE) is finally decreasing. So MTA-STS looks like the path forward. Lots of folks have been predicting this. [2] [1] https://www.uriports.com/blog/mta-sts-survey-2024/ https://www.uriports.com/blog/mta-sts-survey-2024/ [2] https://www.verisign.com/en_US/company-information/verisign-labs/internet-security-tools/dnssec-scoreboard/index.xhtml https://www.verisign.com/en_US/company-information/verisign-...

Avamander 2y ago

It's quite a bit more accessible than DANE, so uptake has increased in the last few years. A bunch of high-volume operators support it, like gmail. But support also exists in newer MTA software like Stalwart, Maddy and ZoneMTA. (Though there are ways to add MTA-STS support to Postfix as well.) MTA-STS has a great benefit that one doesn't need to deal with the antiquities of their registrars or TLD operators, just set up a few records and run a web server. WebPKI in general is also significantly better than DNSSEC. So you win twice. Though MTA-STS doesn't cover the part between MUA and MSA unfortunately, I've seen an abandoned draft for MUA-STS but that's about it.

newman314 2y ago
You can actually run MTA-STS on Cloudflare Workers so the web server piece isn't even necessary. It was fairly easy to implement and works well for me.

upofadown 2y ago

Exim doesn't support MTA-STS[1] although there is a perl script available[2]. [1] https://www.exim.org/exim-html-current/doc/html/spec_html/ch-encrypted_smtp_connections_using_tlsssl.html https://www.exim.org/exim-html-current/doc/html/spec_html/ch... [2] https://github.com/Bobberty/MTASTS-EXIM-PERL https://github.com/Bobberty/MTASTS-EXIM-PERL