4

In my understanding (please correct if applicable),

  • The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote one.
  • The server-to-server transit across the web is generally insecure.
  • At the other end, the recipient' server may again have a secure connection with his/her client.

So there is a potential gap of security in the middle.

Is there a way to ascertain whether an email has sailed the web, server-to-server, securely? This question applies to all parts of a mail (header, content, attachment).

  • No. At least not with any level of certainty. And while you can encrypt the content of the email, and (depending on the local MTA) forge the header, you can't hide the recipient nor other data added in the envelope/header. – symcbean Oct 2 '17 at 11:45
  • Actually, server-to-server is becoming more likely to be encrypted by the day. SMTP opportunistic STARTTLS encryption is supported by many of the major providers, and many many smaller ones as well. However, bear in mind that this only provides transit security ("on the wire"), not security while the message is being processed by the respective mail server. – a CVn Nov 1 '17 at 10:09
  • @MichaelKjörling another side of the story is the exact SSL/TLS version used by all of the transit servers, ciphersuites involved, and so on. It's better not to rely on transit encryption at all. – ximaera supports Monica Jan 30 '18 at 16:33
2

Many (but not all) SMTP server report receiving over encrypted channel in Received: header.
You may use it to check encryption over "the last SMTP hop" if your incoming/MX server reports it.

Sample Received: header with encrypted link indicator:

Received: from mail.mpap.mp.br (HELO webmail.mpap.mp.br) ([186.249.223.20])
          (envelope-sender <x@mpap.mp.br>)
          by mx.example.net with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
          for <x@example.net>; 30 Sep 2017 07:39:42 +0000
  • Do e-mail reports afford a possibility to trace all the hops? – XavierStuvw Oct 2 '17 at 8:36
  • 1
    @XavierStuvw Every mail server is supposed to add its own Received: header, and not touch any earlier ones, as it receives a message for further handling. They are called "trace headers" or "trace information" in the relevant standard. tools.ietf.org/html/rfc5321#section-4.4 However, the exact details to be included are only specified to the point of what is required to trace the message's path, not information about how it was transferred. So mail servers are perfectly free to not include information on e.g. encrypted transport. – a CVn Nov 1 '17 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.