4

I'm using my own root server for my email accounts. All the traffic between my pc and my server is encrypted. Is there a possibility to force my email-server to communicate with other email-servers also encrypted?

3
  • 1
    Other SMTP servers could probably relay mail over unencrypted links, anyway. Short of PGP, I don't think you can rely on email being secure.
    – gparent
    Apr 14, 2012 at 20:14
  • Which MTA (mail server) are you using?
    – grifferz
    Apr 14, 2012 at 20:19
  • It really depends on your threat model -- what you're trying to protect from whom.
    – cjc
    Apr 14, 2012 at 21:50

2 Answers 2

12

Yes, you can tell your mail server that you want it to use encryption when talking to other mail server. Of course, there is always the possibility that the mail server on the other side of the SMTP connection don't want to establish an encrypted connection. Hence you will need to have a policy on whatever to allow the connection to proceed or not in such a case.

The two configuration options you are after are smtp_tls_security_level and smtpd_tls_security_level. smtp_tls_* controls sending while smtpd_tls_* controls receiving.

The usually sensible thing, for Internet wide e-mail, is to allow for opportunistic encryption. That translates into the config value may.

smtp_tls_security_level = may
smtpd_tls_security_level = may
2
  • so smtpd_* is for the communication between my pc and my mailserver and smtp_* is for the communication between my mailserver and other mailservers?
    – soupdiver
    Apr 15, 2012 at 11:14
  • 4
    Kind of, but not necessarily, that depends. The smtp_ configs are for when your server initiates the connection, when it sends e-mail to other mail servers. The smtpd_ settings are for when your mail server is on the receiving/listening end of a connection, which would apply when your PC is initiating the connection. It would also apply in case your mail server is a MX server, having other mail servers connecting to it.
    – andol
    Apr 15, 2012 at 12:25
5

Only if they support SSL as well.

I assume from the tag you are using postfix. There is an option in main.cf for that: smtp_tls_security_level.

You can have it verify certificates or not, or use SSL when available but still send email when it isn't. Keep in mind that requiring encryption will make any mail you send to sites that do not support SSL undeliverable, and requiring valid certificates will make mail undeliverable from your site to those with self-signed certificates.

Here is the documentation for that option: http://www.postfix.org/postconf.5.html#smtp_tls_security_level

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .