12

In my understanding, most of email servers use SMTP/POP/IMAP over SSL to encrypt the email.
It supports encryption when client (UA) send email to server (MTA) and UA receive email from MTA. However, not so many MTAs can encrypt when they send email between MTA to MTA.
(is my understanding correct?)

e.g. [email protected] send email to [email protected]
[Alice's PC] --- encrypted (SMTPS) ---> [somewhere.com server] --- NOT ENCRYPTED (SMTP) ---> [anywhere.org server] --- encrypted (POPS or IMAPS) ---> [Bob's PC]

If my understanding is correct, why most email servers don't support SMTP over SSL between email servers?

I develop better (less complex) interface to enable email encryption with PGP/GPG, but these days I think it may be better to use SMTPS because PGP/GPG needs manual key signing to keep reliability.

6
  • What has this to do with email encryption? email encryption means to me that the email is encrypted on its own...
    – Uwe Plonus
    Jan 16, 2013 at 7:12
  • ?? Sorry, I didn't understand what you mean... How "email is encrypted on its own"? In my understanding, email can be easily intercepted if you send email as plain text (without encryption). Jan 16, 2013 at 7:23
  • 1
    Yes, but sending an encrypted email has nothing to do with the SSL/TLS encryption of the SMTP server.
    – Uwe Plonus
    Jan 16, 2013 at 7:25
  • 1
    To make sure that you only receive mail over an encrypted channel on your SMTP server, you'll have to force using TLS. So, if the other party doesn't understand/support TLS, you won't receive your mail. If you allow a fallback to unencrypted communication, you achieved nothing. This is why people rather opt to encrypt the mail itself and send it over an unencrypted channel. Jan 16, 2013 at 12:28
  • To clarify: "encrypted email" refers to encrypting the contents using something like PGP before you even send it to your outgoing mail server. That has the added advantage of keeping it secret from whoever runs your MTA. It does not refer to encrypting the email between MTAs; encryption is normally applied only at the ends, not in the middle. Note also that communication between UA and MTA often involves transmitting some form of password, which should be encrypted anyway.
    – cpast
    Jan 17, 2013 at 3:42

1 Answer 1

4

Good question, I really haven't seen any figures for this. I'm not sure, but I think many large companies now support SSL/TLS for inbound and outbound SMTP ("MX" mail delivery). This is normally optional and can be negotiated via StartTLS on port 25. Most SMTP servers do not require server to server TLS, however, as it would mean many would not be able to receive mail from an MTA that does not support or is not configured for TLS.

Many email clients support TLS between the UA and MTA - either SMTP/IMAP over SSL or POP3 over SSL. I think gmail for example requires SSL/TLS for IMAP and POP3.

Regarding actual end to end email encryption, this is normally achieved using S/MIME or PGP. However, due to the complexities in setting this up and managing it, it has not seen wide-scale adoption.

3
  • Thank you. So my understanding for current state for email encryption. You mean server-to-server SMTPS is not supported in many servers because server software like postfix don't support it? If most of mail server support it, the problem will be solved? (Maybe I don't understand your answer correctly...) Jan 17, 2013 at 4:41
  • Even when encryption is negotiated, usually no strict checking of the certificates is done because that would block all those servers with self-signed certs. But without strict checking a man-in-the-middle attack is easy (not to mention that a MITM might prevent STARTTLS by intervening the cleartext phase) Nov 27, 2015 at 12:25
  • RFC 2487 forbids public mail servers from requiring TLS: "A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure."
    – ARX
    Feb 21, 2019 at 3:19

Not the answer you're looking for? Browse other questions tagged .