0

I run a simple web service, and I need to securely send emails to users via PHP.

There are no mailboxes/accounts involved. It is a simple send-only function.

Without involving PGP, I have come up with the following options -

  1. Use local SMTP server and configure outgoing TLS (could still travel via plaintext across the internet?)
  2. Check user's email address. If its @gmail.com (or hotmail/outlook/yahoo) then send to Gmail/Hotmail/etc SMTP server using TLS (pretty likely to be encrypted all of the way?)
  3. Any other options?

Appreciate any help/thoughts.

Improve this question
8
  • If you only want to send them secure, use a mailing service that accepts a API call over SSL. If you want to make sure they receive their email securely, that's not always up to you.
    – Yorick de Wid
    Commented Aug 24, 2016 at 17:17
  • Steffen gave you a good answer. I'd like to add that you seem to be having an XY Problem, perhaps you would benefit from telling us what you're really trying to accomplish.
    – GnP
    Commented Aug 24, 2016 at 17:21
  • @YorickdeWid Can you elaborate on an API call over SSL? You mean something like using Gmail/Yahoo SMTP over port 587 or 465?
    – MrRobot909
    Commented Aug 24, 2016 at 17:32
  • @GnP +1 really appreciate Steffan's response. I'd disagree with your XY comment. It's pretty simple, I need to send "important information" to a number of email addresses securely. This email address could be random and no user information/PGP keys are known.
    – MrRobot909
    Commented Aug 24, 2016 at 17:38
  • @MrRobot909 nope I ment a mailing service, Mailgun etc.. They allow you to call an (REST) API, and they handle all the SMTP(S)/SSL stuff for you.
    – Yorick de Wid
    Commented Aug 24, 2016 at 17:49

1 Answer 1

Reset to default
2

I run a simple web service, and I need to securely send emails to users via PHP.

Your exact requirements of "securely send emails" are unknown. But none of your proposals offers end to end security, i.e. depending on the path one or many parties can intercept and even modify the mail.

In detail:

SMTP has only hop-by-hop encryption, which means any MTA on the way will have the mail in clear even if TLS was used to transmit the mail to the MTA.

Also there is no guarantee that TLS is used at all because SMTP transfer starts plain (without encryption) and only gets upgraded optionally to TLS with the STARTTLS command. If this fails or if no STARTTLS is offered by the receiving MTA the mail is usually send plain text (i.e. best effort encryption). There are various ways TLS can fail (bad configuration) or can be made to fail by an attacker and there are also firewalls which simply transparently strip STARTTLS support so that they can look into the mail.

Apart from that the next hop MTA is chosen by the DNS MX record. With DNS spoofing the mail can thus be redirected/intercepted unless the sending MTA is using strict DNSSec, which it usually isn't.

Improve this answer
6
  • Thanks Steffen for explaining things in detail. Can I follow up by asking - If I know a recipients email address is Gmail for example, can't I simply verify the MX record for Gmail.com and then attempt to directly establish a secure connection to this server? #Edit - I believe services like GuerrilaMail do these kind of checks, to check if TLS is available and therefore securely send mail. My knowledge isn't too good in this area.
    – MrRobot909
    Commented Aug 24, 2016 at 17:23
  • @MrRobot909: so how do you "verify" the MX record?
    – Steffen Ullrich
    Commented Aug 24, 2016 at 17:26
  • Again I'm relatively new to this, but can't this be done using DIG, followed by nmap, followed by "$ openssl s_client -connect mx1.gmail.com:25 -starttls smtp"
    – MrRobot909
    Commented Aug 24, 2016 at 17:34
  • @MrRobot909 that's what any MTA will do to send the message. But note how you haven't "verified" anything, you accepted a DNS response (dig) tested a port (I assume that's what the nmap was for) and connected to it. At what point did you verify you were actually talking to gmail and not some attacker?
    – GnP
    Commented Aug 24, 2016 at 19:19
  • @MrRobot909: to make sure that the DNS response you got (with dig, by the MTA, ....) is not spoofed you would need DNSSec.
    – Steffen Ullrich
    Commented Aug 24, 2016 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .