Do all email servers (also different providers) that implement tls, use tls to encrypt the messages and headers?
Could the missing of tls-encryption be a sign of ssl-downgrading and how to find out if a server does implement tls?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityDo all email servers (also different providers) that implement tls, use tls to encrypt the messages and headers?
Usage of TLS in transporting email does not encrypt the email itself the same as use of TLS in HTTP does not encrypt the request and the response specifically. Instead the underlying connection is encrypted, either from start (smtps, port 465) or after a STARTTLS command (smtp, port 25). By encrypting the underlying connections everything inside this connections gets protected, which include in case of SMTP the mail but also the SMTP commands for authorization, specification of sender and receiver etc.
... and how to find out if a server does implement tls?
You can connect to the server and speak the SMTP protocol, issue a EHLO request and check if the response contains the information that the server supports the STARTTLS command:
$ telnet aspmx.l.google.com 25
220 mx.google.com ESMTP b48si10559063wrb.307 - gsmtp
ehlo myhost
250-mx.google.com at your service
...
250-STARTTLS
But note that contrary to the use of TLS for HTTP (i.e. HTTPS) TLS in SMTP does not provide an end-to-end encryption from sender to recipient but only a hop-by-hop encryption between the mail transfer agents (MTA). Thus you only find out from this that a specific MTA supports TLS and not that all the hops on the way to a specific recipient do it. Also each hop has the mail in clear text, i.e. only the transport between the hops is protected with TLS.
Could the missing of tls-encryption be a sign of ssl-downgrading ...
There are some firewalls which strip STARTTLS from the response and thus cause the client to not use TLS.