SMTPS
This article gives you an understanding of Simple Mail Transfer Protocol Secure (SMTPS) and its security considerations.
Problem. SMTP does not encrypt its communication between client and server. This becomes a problem, if the communication is routed through an untrusted router. This allows untrusted routers to read potentially sensitive communication or makes the communication easier to alter.
SMTPS. SMTPS is an extension to SMTP, which allows encryption over TLS. The
client starts by initiating an extended hello message (EHLO). If the server
indicates that STARTLS is available, then the client can choose to start a
TLS negotiation. Here is a slightly modified example from RFC
3207
Now, you know the basics of SMTPS and we can begin to critically think about its implications. In the following we prepared a few questions that allows you to think about a few aspects of SMTPS.
What are the use cases of SMTPS?
- SMTPS primarily protects the confidentiality of SMTP communication and mails. It is important to note, that SMTPS not only protects the mails itself, but also meta information that is sent. For example, the client may use login and password to authenticate itself to the server; this data is encrypted as well.
- Servers can use SMTPS to authenticate each others identities.
- The encryption of the messges makes them harder for attackers to change in a meaningful way.
Security considerations.
Both SMTP client A (mx06.A.com) and SMTP server B (mx00.B.com) have a
valid TLS certificate for their subdomain domain. This means that they
can verify that they are from a certain domain. Does this functionality
replace SPF?
No it does not.
Ressources
For more information I would suggest you to take a look at the RFC 3207. It is pretty short and to the point.