3 ms·

Old version: * DNS lookup for MX record New version * DNS lookup for A record * HTTP request for .wellknown/htmp/known_hosts Not sure why this is being con

Old version: * DNS lookup for MX record New version * DNS lookup for A record * HTTP request for .wellknown/htmp/known_hosts Not sure why this is being considered as an improvement? > each mailbox of a domain on a different provider Why is this useful/necessary or even 'good'?

rzerowan 3mo ago
Id think its for enduser flexibility and convenience. Its more involved to alter DNS records vs just adding a text line to a webpage and hitting that default endpoint as standard. Same way LetsEncrypt allows the easiest setup with the .wellknown endpoint , where a user may not have DNS access beyond the initial A record setup.
- inigyou 3mo ago
  Why is one more involved than the other? DNS is just a text file too. And you might not even have a web server. Why should mail servers be required to also be web servers? And what if the web server for that domain is already a completely separate system, and now you force it to be linked to the email system?
stackskipton 3mo ago
It's not a good idea, I'd call it terrible in fact. We have MX Records, might as well use those. If not, use SRV records. Requiring mail server to involved in root of the domain is terrible idea.
8organicbits 3mo ago
Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.
- winstonwinston 3mo ago
  To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE). I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.
  - tptacek 3mo ago
    So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?
    - 8organicbits 3mo ago
      When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-yet/ https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.
  - 8organicbits 3mo ago
    Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended. What concerns do you have with MTA-STS?

rzerowan 3mo ago

Id think its for enduser flexibility and convenience. Its more involved to alter DNS records vs just adding a text line to a webpage and hitting that default endpoint as standard. Same way LetsEncrypt allows the easiest setup with the .wellknown endpoint , where a user may not have DNS access beyond the initial A record setup.

inigyou 3mo ago
Why is one more involved than the other? DNS is just a text file too. And you might not even have a web server. Why should mail servers be required to also be web servers? And what if the web server for that domain is already a completely separate system, and now you force it to be linked to the email system?

stackskipton 3mo ago

It's not a good idea, I'd call it terrible in fact. We have MX Records, might as well use those. If not, use SRV records. Requiring mail server to involved in root of the domain is terrible idea.

8organicbits 3mo ago

Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.

winstonwinston 3mo ago
To be fair, it’s used by only those who choose to use horrendous “mta-sts” instead of DNS-based Authentication of Named Entities (DANE). I might add that if you want to enforce SMTP TLS, you can do just that without mta-sts or DANE.
- tptacek 3mo ago
  So, basically everybody? DANE has virtually no uptake. I think it might literally just be Microsoft at this point?
  - 8organicbits 3mo ago
    When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-yet/ https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.
- 8organicbits 3mo ago
  Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended. What concerns do you have with MTA-STS?