4

In my understanding (please correct if applicable),

  • The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote one.
  • The server-to-server transit across the web is generally insecure.
  • At the other end, the recipient' server may again have a secure connection with his/her client.

So there is a potential gap of security in the middle.

Is there a way to ascertain whether an email has sailed the web, server-to-server, securely? This question applies to all parts of a mail (header, content, attachment).

Improve this question
3
  • No. At least not with any level of certainty. And while you can encrypt the content of the email, and (depending on the local MTA) forge the header, you can't hide the recipient nor other data added in the envelope/header.
    – symcbean
    Commented Oct 2, 2017 at 11:45
  • Actually, server-to-server is becoming more likely to be encrypted by the day. SMTP opportunistic STARTTLS encryption is supported by many of the major providers, and many many smaller ones as well. However, bear in mind that this only provides transit security ("on the wire"), not security while the message is being processed by the respective mail server.
    – user
    Commented Nov 1, 2017 at 10:09
  • @MichaelKjörling another side of the story is the exact SSL/TLS version used by all of the transit servers, ciphersuites involved, and so on. It's better not to rely on transit encryption at all.
    – ximaera
    Commented Jan 30, 2018 at 16:33

1 Answer 1

Reset to default
2

Many (but not all) SMTP server report receiving over encrypted channel in Received: header.
You may use it to check encryption over "the last SMTP hop" if your incoming/MX server reports it.

Sample Received: header with encrypted link indicator:

Received: from mail.mpap.mp.br (HELO webmail.mpap.mp.br) ([186.249.223.20])
          (envelope-sender <[email protected]>)
          by mx.example.net with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
          for <[email protected]>; 30 Sep 2017 07:39:42 +0000
Improve this answer
2
  • Do e-mail reports afford a possibility to trace all the hops?
    – XavierStuvw
    Commented Oct 2, 2017 at 8:36
  • 1
    @XavierStuvw Every mail server is supposed to add its own Received: header, and not touch any earlier ones, as it receives a message for further handling. They are called "trace headers" or "trace information" in the relevant standard. tools.ietf.org/html/rfc5321#section-4.4 However, the exact details to be included are only specified to the point of what is required to trace the message's path, not information about how it was transferred. So mail servers are perfectly free to not include information on e.g. encrypted transport.
    – user
    Commented Nov 1, 2017 at 10:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .