6

How can I technically verify* that the e-mail I'm sending from Gmail to Yahoo is encrypted all the way from Gmail's servers to Yahoo's servers? I know that it's advised to have encryption between the mail service provider and the client's desktop, e.g. using IMAPS or SMTPS, and when using a web interface, HTTPS. But if an e-mail is sent from e.g. the web interface, then that e-mail could be sent in "plain text" format through the mail relay servers until it reaches its destination mail service provider.

* besides reading the corresponding FAQs

Improve this question

3 Answers 3

Reset to default
4

First of all, you need to know the server IP's and ports. There are often included descriptions what protocol they are speak on which port:

Googlemail - Gmail
                    Server:         Authentication:     Port:
SMTP Server         smtp.gmail.com  SSL                 465
                    smtp.gmail.com  StartTLS            587
IMAP Server         imap.gmail.com  SSL                 993

Server List from ARCLAB.

To check by yourself, you can use openssl:

openssl s_client -crlf -connect smtp.gmail.com:993

and the output:

---
SSL handshake has read 3238 bytes and written 435 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: 92C91152E2BBD7BC1A40889A4B31BB343045275F823F658B5042752B5FFCD072
    Session-ID-ctx: 
    Master-Key: DE4696E40209CB2358ECD9A57537BCBAAC8892E4B1E243C9218F102997741B780C987F4CF7CFEFE7F66919496AFF1D4A
    Key-Arg   : None
    Start Time: 1403632088
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
* OK Gimap ready for requests from 87.17X.XXX.XX qbxmb6xx690wic

Secure connections between SMTP MTA's is done mostly via TLS. TLS is unlike SSL an extra feature which is initialized with the SMTP command STARTTLS.

You'll never know if a Google SMTP Server is sending via TLS to yahoo and vice versa, except you have access to the network between and you can sniff them. But you can at least check if the servers understand TLS. So if a server is configured for TLS, it will connect to yahoo or google servers via TLS.

host -t mx yahoo.com
yahoo.com mail is handled by 1 mta5.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta6.am0.yahoodns.net.
yahoo.com mail is handled by 1 mta7.am0.yahoodns.net.

openssl s_client -starttls smtp -connect mta5.am0.yahoodns.net:25 -showcerts

and the same for google 

host -t mx google.com
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

openssl s_client -starttls smtp -connect alt1.aspmx.l.google.com:25

And the output:

---
SSL handshake has read 3985 bytes and written 470 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: 5BD83CAF6233F40A7CE5161232DDDDEB89D548C2E35CD12904ED766A4725CA83
    Session-ID-ctx: 
    Master-Key: CA3AB66161D5A6464D0CAE30E614CABE5B44EFAAE7CE41377A7C18607DBC010E12C0DE42095CABE76E569ED77359367D
    Key-Arg   : None
    Start Time: 1403643466
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
250 CHUNKING
Improve this answer
2
  • Cipher : RC4-SHA -> what the hell is this? :O Google uses the old RC4? Why?
    – evachristine
    Commented Jun 25, 2014 at 5:56
  • client negotiates the steam cipher.
    – user36486
    Commented Jun 27, 2014 at 3:26
4

You can look at the raw email headers and see if they have pertinent information in there.

I've just looked at a few that came via Google and noticed Received: from XXXXXXXXXXXXX(XXXXXXXXXXXX. [x.x.x.x]) by mx.google.com with ESMTPS id xxxxxxxxxxxxx.73.2014.06.24.07.31.28 for version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128. That suggest to me that Google received it via encrypted SMTP.

However, I believe that the messages that email servers place in the headers do not follow any mandatory standard and therefore it could be delivered via an encrypted SMTP connection even when the headers don't state that. I suppose it's unlikely (but not impossible) that any service provider would claim that they received it via encrypted SMTP when they haven't, so it's a safe bet that if all your hops are encrypted then you're OK (but not guaranteed).

Improve this answer
-1

You can check whether the Gmail webmail interface is connected to the server via an encrypted connection by checking if it's an HTTPS connection in your browser. You can do it by clicking on the icon left to the address bar in Firefox.

You can do it for Yahoo as well.

However, I don't know any trusted method for checking if your data travels encrypted among the two servers (most likely it does).

Improve this answer
4
  • Just because the browser's connection to the provider is using HTTPS doesn't mean that the provider is using SMTPS/TLS to send/recieve email. It would be nice, but it isn't necessarily true
    – Creek
    Commented Jun 24, 2014 at 17:26
  • @Creek As I noted in my answer, this only indicates that the webmail interface is connected via a secure HTTPS connection.
    – psimon
    Commented Jun 24, 2014 at 17:30
  • I see that, but your answer doesn't solve OP's question, "How to check that an e-mail service provides encryption between the mail servers?"
    – Creek
    Commented Jun 24, 2014 at 17:50
  • @Creek I understand. Well, it partially does. The other part (checking server-to-server communication) was beyond my knowledge. However, I decided to write an answer as it was too long for a comment.
    – psimon
    Commented Jun 24, 2014 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .