1

I'm writing up documentation and want to ensure that I'm using proper terminology.

1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, involves checking ESMTP capabilities for 250-STARTTLS and issuing the STARTTLS command (followed by negotiation, public cert exchange, etc)?

2) Likewise, what is the proper technical term for SMTP tunnel encryption that uses port TCP/465 and requires negotiation immediately

I've always just called #1 "TLS Encryption"/"TLS" and #2 "Secure SMTP"/"SMTPS" but I don't think that's accurate.

Improve this question
4
  • To add to the other answers, I would refer to STARTTLS as "opportunistic TLS encryption".
    – executifs
    Jun 25, 2014 at 11:33
  • @executifs That would make sense if I didn't require the use of STARTTLS when sending to some domains but I don't think it is necessarily appropriate for all use cases of option 1. For example, what if I explicitly require the use of STARTTLS when sending to bob.com?
    – Mike B
    Jun 25, 2014 at 14:52
  • From what I understand, you cannot "explicitely require" STARTTLS... It is a way to upgrade a session to a secure channel, but if the other server doesn't support it, nothing happens, and there is no way of making the other party comply. Hence the "opportunistic" description.
    – executifs
    Jun 25, 2014 at 14:57
  • @executifs Sorry if I was unclear. I'm referring to features like TLS_Srv:secure.domain ENCR:112 in sendmail which lets you require a minimum bit strength for a TLS session and defer the message if the other side doesn't have TLS or doesn't meet the minimum requirement. Details here: sendmail.com/sm/open_source/docs/m4/starttls.html
    – Mike B
    Jun 25, 2014 at 17:11

2 Answers 2

Reset to default
2

I've mostly seen the first case referred to as "SMTP with STARTTLS" and the 2nd as "SMTPS". The first case is defined by RFC3207 which has the name "SMTP Service Extension for Secure SMTP over Transport Layer Security," but that's too much of a mouthful for use in documentation. I've also seen "the STARTTLS extension" when the rest of the context makes it clear that SMTP is being discussed.

Improve this answer
1

The emailing application on my smartphone (the stock one from Android 2.2) designates the SMTP-within-SSL on port 465 as "SSL", and the STARTTLS command (within a port 25 connection) as "TLS". This is atrociously wrong and confusing, but so it is.

Personally I'd use "STARTTLS" or "SMTP+STARTTLS" (if the "SMTP" part is not obvious from context) to designate the use of port 25 and STARTTLS command; for the other case, "SMTPS", as @David suggests, is quite good, by analogy with HTTPS.

(The same debate exists for IMAP, with similar conclusions.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .