4 ms·
This isnt exactly news but I guess a good site with a codename is needed to fix things nowadays. Also, its nice and dandy to have postfix use SSL but SMTP TLS
by zobzu 11y ago
This isnt exactly news but I guess a good site with a codename is needed to fix things nowadays.
Also, its nice and dandy to have postfix use SSL but SMTP TLS is always set to opportunistic and can be degraded to no encryption by a MITM - because, you know, compatibility.
- talideon 11y agoDANE can at least partly mitigate this, though that assumes that you've DNSSEC set up, along with TLSA records for your mailservers. Setting up DNSSEC is another kettle of fish, mind.
- yuhong 11y agoYea, DNSSEC has its own problems. Personally I think a version of HSTS for mail is the best idea for now.