Do all email servers (also different providers) that implement tls, use tls to encrypt the messages and headers?
Could the missing of tls-encryption be a sign of ssl-downgrading and how to find out if a server does implement tls?
Do all email servers (also different providers) that implement tls, use tls to encrypt the messages and headers?
Usage of TLS in transporting email does not encrypt the email itself the same as use of TLS in HTTP does not encrypt the request and the response specifically. Instead the underlying connection is encrypted, either from start (smtps, port 465) or after a STARTTLS command (smtp, port 25). By encrypting the underlying connections everything inside this connections gets protected, which include in case of SMTP the mail but also the SMTP commands for authorization, specification of sender and receiver etc.
... and how to find out if a server does implement tls?
You can connect to the server and speak the SMTP protocol, issue a EHLO request and check if the response contains the information that the server supports the STARTTLS command:
$ telnet aspmx.l.google.com 25
220 mx.google.com ESMTP b48si10559063wrb.307 - gsmtp
ehlo myhost
250-mx.google.com at your service
...
250-STARTTLS
But note that contrary to the use of TLS for HTTP (i.e. HTTPS) TLS in SMTP does not provide an end-to-end encryption from sender to recipient but only a hop-by-hop encryption between the mail transfer agents (MTA). Thus you only find out from this that a specific MTA supports TLS and not that all the hops on the way to a specific recipient do it. Also each hop has the mail in clear text, i.e. only the transport between the hops is protected with TLS.
Could the missing of tls-encryption be a sign of ssl-downgrading ...
There are some firewalls which strip STARTTLS from the response and thus cause the client to not use TLS.
answered Jan 15 '17 at 15:42
-
You mean by hops, the hops e.g. between Seattle and London, with two different providers or the same provider on the same place ? Does the traffic within the same provider be more secure ? – Tech-IO Jan 15 '17 at 16:12
-
@GiaRui: mail gets not delivered the direct way to the recipient but the sender sends it usually to its local MTA which forwards it to either to the recipients MTA or there are more intermediate MTA involved. And finally it gets stored in some mailbox where the recipient then retrieves it with POP or IMAP. TLS only protects the transport between each of these hops. – Steffen Ullrich Jan 15 '17 at 16:38
-
Is this tracable e.g. with tracert or to look at the original message ? – Tech-IO Jan 15 '17 at 18:03
-
@GiaRui: no it's not. But you can see the hops of the mail delivery when looking at the Received headers of the successfully transferred mail since commonly each MTA adds a new Received header. And many also include in this header if the mail was transferred with TLS. But you cannot reliably find out the path a mail will take up-front. – Steffen Ullrich Jan 15 '17 at 18:07
-
It's a bit tricky to read it. It starts on bottom with the first hop and go up. There are also some x-received hop and sometimes ipv6 sometimes ipv4. And also if signed with tls and digital signature(DKIM-Signatur) among other things. Okay Thanks. – Tech-IO Jan 15 '17 at 19:12
