Timeline for Sending Mail Using TLS
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 19, 2020 at 22:00 | comment | added | mti2935 | Bear in mind that even DNSSEC can be compromised by a rogue registrar, the TLD, or the root. See moxie.org/blog/ssl-and-the-future-of-authenticity. | |
| Aug 24, 2016 at 19:45 | vote | accept | MrRobot909 | ||
| Aug 24, 2016 at 19:22 | comment | added | Steffen Ullrich | @MrRobot909: to make sure that the DNS response you got (with dig, by the MTA, ....) is not spoofed you would need DNSSec. | |
| Aug 24, 2016 at 19:19 | comment | added | GnP | @MrRobot909 that's what any MTA will do to send the message. But note how you haven't "verified" anything, you accepted a DNS response (dig) tested a port (I assume that's what the nmap was for) and connected to it. At what point did you verify you were actually talking to gmail and not some attacker? | |
| Aug 24, 2016 at 17:34 | comment | added | MrRobot909 | Again I'm relatively new to this, but can't this be done using DIG, followed by nmap, followed by "$ openssl s_client -connect mx1.gmail.com:25 -starttls smtp" | |
| Aug 24, 2016 at 17:26 | comment | added | Steffen Ullrich | @MrRobot909: so how do you "verify" the MX record? | |
| Aug 24, 2016 at 17:23 | comment | added | MrRobot909 | Thanks Steffen for explaining things in detail. Can I follow up by asking - If I know a recipients email address is Gmail for example, can't I simply verify the MX record for Gmail.com and then attempt to directly establish a secure connection to this server? #Edit - I believe services like GuerrilaMail do these kind of checks, to check if TLS is available and therefore securely send mail. My knowledge isn't too good in this area. | |
| Aug 24, 2016 at 17:14 | history | answered | Steffen Ullrich | CC BY-SA 3.0 |