When configuring a mailgateway’s TLS Settings, should one stick to the same rules for Cipher Suites as in running a HTTPS Service (prefer EDCHE/DHE, disable SSLv3, not use stuff like RC4, etc.) or should one focus more on compatibility with other MTAs to prevent email getting sent unencrypted?
It seems to me that it’s a tradeoff. On the one hand, if I use only strong Cipher Suites I’m improving the security of a majority of mails transferred because you can’t downgrade to weak Cipher Suites or SSLv3. But on the other hand, I give up encryption for some mails altogether, because they get sent unencrypted (if the other MTA is extremly old and supports only RC4, for example).