4 ms·
"Unfortunately, in order to be RFC-compliant, an MTA cannot refuse to transfer mail just because encryption (TLS) is not available." If you are running a mail
by mike-cardwell 12y ago
"Unfortunately, in order to be RFC-compliant, an MTA cannot refuse to transfer mail just because encryption (TLS) is not available."
If you are running a mail system like Postfix, with DNSSEC and DANE turned on, then your server will refuse to deliver mail to mine unless it can negotiate a TLS encrypted connection, and the certificate used matches the cryptographically signed fingerprint I publish in the DNS.
http://tools.ietf.org/html/draft-ietf-dane-smtp-01 http://tools.ietf.org/html/draft-ietf-dane-smtp-01
- jlgaddis 12y agoYes, sorry, I should have been more clear -- I was specifically referring to it being a violation of RFC2487 to require TLS on a publicly referenced SMTP server (on 25/TCP anyways) that is accepting mail. One can obviously configure his/her own MTA to not send out mail unless encryption is being used (although one would certainly end up with undeliverable mail), but RFC2487 says that you may not refuse to accept mail (again, on 25/TCP) that is not encrypted. As with DNSSEC and DANE, like you mentioned, one can also require his/her MTA to validate the server's certificate although this isn't typically enabled by default.