3

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.


Additionally, as the answer from Jeff shows, O365 will use TLS whereever possible, so TLS will (should) be used between data centres, I'm still curious is there's an MPLS / Private network between the data centres and the traffic never leaves the O365 infrastructure?

  • You have to elaborate on what you mean by "secure". What is your threat model? If you are asking whether or not the different entities can create specially crafted documents which could exploit the Office programs, then yes, it would not be particularly difficult to do so. – forest Apr 5 '16 at 10:09
  • @forest I've edited to add more information - simply that the contents of the email are encrypted between mailboxes is the genral gist! – RemarkLima Apr 5 '16 at 10:30
  • Whether traffic between Microsoft data center is encrypted shouldn't change your approach to security. O365 internal network encryption is probably secure enough for most business communication, but you should always do your own encryption for things you really care about. Ultimately your email provider can always read any emails that is not encrypted end-to-end. – Lie Ryan Apr 7 '16 at 4:54
8
+50

As luck would have it, Microsoft has documented this. The answer to your question is yes. They use TLS 1.2 between any Office 365 groups, and they also use it opportunistically for external destinations, so as long as the recipient's server supports it, that message path will also be encrypted.

https://technet.microsoft.com/en-us/library/mt163898.aspx

and not to humblebrag or criticize, but to find this I literally googled "does office365 use tls to send email"

  • I guess my edit for more info just focused on encryption, but this still implies that the traffic can / does leave the Microsoft network between data centres. Whilst still encrypted, so it means it is as secure as any TLS endpoint, I'm still curious is there's an MPLS / Private network between the data centres and the traffic never leaves the O365 infrastructure? – RemarkLima Apr 5 '16 at 21:06
  • 1
    That part, unfortunately, is something they don't talk about much. Considering how much traffic they have between datacenters, and that they use MPLS extensively in Azure, it would be surprising if they did not use it exclusively in inter-datacenter traffic, but that's speculation. I don't think a claim like "traffic never leaves the o365 infrastructure" is likely though since all of their datacenters have several high priority tasks, that probably share network infrastructure. – Jeff Meden Apr 6 '16 at 13:22
1

Regarding TLS SMTP communications: there is an issue with downgrade attacks.
Basically, you can't trust email transactions to be 100% encrypted.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM, a US government program to snoop on communications (even between US citizens within the US!) by taking advantage of the fact that Microsoft and other major internet companies would sync data between backend servers on unencrypted network connections across continents.

There was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.

Being three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)

-1

You read this part, which I emphasized a few keywords:

Office 365 sends mail using TLS encryption, provided that the destination server also supports TLS. If your partner organization supports TLS, you only need to create a connector if you want to enforce certain security restrictions

Then the answer to your question is:

not systematically or…

it depends :).

The following traffics aren't encrypted:

  • MX to MX traffic between two Office 365 servers which didn't configure a connector to exchange with each other;

  • MX to MX traffic between an Office 365 server and any other MX running for example a Postfix, a Sendmail or an Exchange server;

  • client to MX traffic of clients not using Office 365 and not willingly configured to use IMAPS and STARTTLS on top of SMTP.

Moreover, this isn't your question, but need to be reminded in a correct risk analysis approach, there remain a lot of places where your E-mail is in clear and not magically secured (I mean encrypted, protected against unwanted reading):

  • on any recipient E-mail client which security you can't ensure, can't imagine, and can't trust :).
  • Please read the MS article I posted in my answer, which contradicts some of the things you asserted. You are correct in your assessment of the premise laid out in the connector config article, but there is more to it than that. – Jeff Meden Apr 5 '16 at 17:42
  • I read it, and I felt it was a note targeting the consumer market. ---- Are you refering to this §: "Unless you have configured Exchange Online to ensure that messages to that recipient are only sent through secure connections, then by default the message will be sent unencrypted if the recipient organization doesn’t support TLS encryption." – daniel Azuelos Apr 5 '16 at 18:04
  • That specific quote means that you will end up sending unencrypted emails to recipients who don't support encryption, something that the question here fully acknowledges. The connector is meant, in that case, only to stop you from unknowingly sending them, it does not enable some encryption mechanism since TLS will always be used by default. – Jeff Meden Apr 5 '16 at 19:07
  • And that gets back to the original problem with your answer, the connector article describes it this way: "By default, Office 365 sends mail using TLS encryption, provided that the destination server also supports TLS. If your partner organization supports TLS, you only need to create a connector if you want to enforce certain security restrictions". This means that, since Office365 is TLS enabled, any email between two mailboxes for Office365 (unless the domain forcibly routs it outside by using contorted external MX records) will be TLS encrypted. – Jeff Meden Apr 5 '16 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.