3

I have several SMTP servers on various networks around the world, and all of them are getting mail through ESTMPS - extended SMTP using TLS.

So the email coming from GMail, MSN, Yahoo, as well MOST of other mail servers, including Exchange servers, Rackspace Email etc, are getting there over ESMTPS. BUT: so-called "secure" Message Labs is doing it plain text. For example (also they use DNS based in US only including the EU):

Received: from mail1.bemta7.messagelabs.com (mail1.bemta7.messagelabs.com [216.82.255.50]) by mail-01 (Postfix) with ESMTP id 6904B757A for ; Mon, 15 Oct 2012 10:59:53 -0700 (PDT)

Another example is gmail:

Received: from mail-pa0-f44.google.com (mail-pa0-f44.google.com [209.85.220.44]) by mail-01 (Postfix) with ESMTPS id E8822161A for ; Sat, 20 Oct 2012 05:11:38 -0700 (PDT)

Does anyone see any reason why it's like this? I use a self-signed certificate on my postfix mail servers, and all I want is to get mail over TLS.

Improve this question
5
  • 1
    You've just proved why security requires end to end encryption and why email itself can't ever be considered secure. Unfortunately unless they are operating from a country with strict advertising laws (like the UK) there isn't all that much that can be done about it.
    – ewanm89
    Commented Oct 20, 2012 at 23:35
  • 2
    In the case of MessageLabs they are trading out of the UK, so you could report them to the Office of Fair Trading, or if you want to let the self regulatory authority attempt it first the Advertising Standards Authority.
    – ewanm89
    Commented Oct 20, 2012 at 23:42
  • or there is an MP or something on MessageLabs board of directors or similar.
    – ewanm89
    Commented Oct 21, 2012 at 13:58
  • All mail is sent as plaintext. Even if you use SSL its still plaintext, the connection might be encrypted, but the message contents are not encrypted. Everyone that recieve the email have to support encrypting the email contents, otherwise, the contents will be sent as plaintext to somebody. Google does not support sending and recieving encrypted email at this time.
    – Ramhound
    Commented Oct 22, 2012 at 11:13
  • I suspect that this is a question that can only be answered by Message Labs. Suggest that the question be rewritten to something that the Stack Exchange community can answer.
    – MCW
    Commented Oct 22, 2012 at 13:05

1 Answer 1

Reset to default
3

TLS is initiated by the sending server. MessageLabs (or Symantec.cloud as they are now known) provide email scanning services for anti-virus, spam, etc and support TLS at two levels: - Opportunistic i.e. if the original mail server initiates a TLS session with the MessageLabs infrastructure it will scan the email and then attempt delivery over TLS. - Enforced - the enforcement is usually configured at the domain level and the message must be received and delivered over TLS.

I suspect in the instance you are showing the original email was not received over TLS so the delivery was completed using SMTP.

I'm not sure about the reference to DNS but MessageLabs has a global infrastructure with data centres in the EU, US and APJ which includes DNS servers. Customers are generally configured on their local infrastructure i.e. EU customers are configured on EU infrastructure, US customers on US infrastructure, etc. Multinational customers maybe configured on both EU and US infrastructure.

Hope this helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .