3

I am currently writing an essay about securing e-mail. Now I'm at the point where I want to know if it's possible to force TLS in connections via SMTP or POP3/IMAP from the clients' side. I know I can configure the client so it uses STARTTLS, which would opportunistically use TLS if available, but I don't know if I can force the client to use only TLS.

Background of this idea will be that no downgrade attack will be possible without noticing.

Does anyone know if there is such an implementation in circulation for Outlook (Or other mail agents)?

1 Answer 1

2

No, Outlook doesn't have an option to force TLS to be used when STARTTLS is selected for the encryption option. But if the server supports it, you can skip STARTTLS and just use TLS on the port where the server implicitly expects it.

Outlook and other email clients generally allow the user to select between "implicit TLS" and "explicit TLS". These terms can be confusing: "implicit TLS" is when the use of the TLS protocol is implied by server with the port number being used (typically 465). In Outlook, one can select the correct port, and then select "SSL/TLS" as the encryption option (for IMAP and SMTP…for POP3, there's just a checkbox and STARTTLS isn't an option). In this case, the connection will fail if the server is not actually expecting SSL or TLS to be used implicitly on that port.

"Explicit TLS" is when the use of the TLS protocol is explicitly specified through the handshaking process of the STARTTLS command processed when the email client connects to the server (typically on port 587). In this case, as long as both the server and client explicitly agree to use TLS, it will be used.

In the normal usage of STARTTLS, the connection may fail to be upgraded to an encrypted connection without the user noticing. This can happen if the server itself doesn't support encryption (rare) or if a man-in-the-middle attack modifies the handshake so that the server and client aren't aware that an encrypted connection was desired.

Outlook does not provide any means to specify that the STARTTLS command should be used, but to only proceed if the server supports TLS.

That said, in some cases the SMTP server itself might support STARTTLS but only allow upgraded connections. Of course, this is of less practical use to the user, since they don't have control over the server's behavior. But you can at least check to see whether the server you're using is configured this way. For example, the answer here: https://security.stackexchange.com/a/252327/145854

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .