9

I am creating an smtp server which will not need to send emails but only receive. Not being an expert, I was wondering if I should still use an SSL certificate for security. For example, if I send an e-mail message from my outlook or gmail client (which I assume will send an already protected message) to my smtp server without ssl, is a man in the middle attack possible?

13

Yes. SSL/TLS should be used on receiving mail. MITM is possible, though requiring DKIM authentication should prevent this from manipulating the message. A signed certificate is the best way to mitigate MITM, and they are free with Let's Encrypt and easily automated if you are using a platform that supports it.

3
  • 3
    There's more to this than just using Let's Encrypt and thinking you are fine: community.letsencrypt.org/t/lets-encrypt-for-smtp/66171 Jun 29 at 14:10
  • Same goes for DANE, as it requires things like a registrar that supports DNSSEC and many don't or make it so difficult that users in practice give up trying to get it enabled. DANE requires a DNS server that supports TLSA records, and many, even major ones, do not. Then sending servers have to respect DANE. A difficult to implement solution typically ends up being a not used one. Also, your comment is for some unexplained reason claiming that I made some reference to Let's Encrypt as a solution instead of what I actually stated which is that it makes the solution easier to implment.
    – Paul
    Jun 29 at 14:34
  • You state that "a signed certificate is the best way to mitigate MITM", which isn't true with SMTP, Let's Encrypt or not. Jul 7 at 4:17
8

What comes to SMTP, TLS is not bulletproof for preventing MitM, because the strong backwards compatibility allows self-signed certificates, older TLS and SSL versions, and even fallback to unencrypted connections. Because an SMTP connection to port 25/tcp always begins in plain text and requires STARTTLS it is easy for a MitM to strip the 250-STARTTLS, making the client believe the server does not support TLS. The DNS-Based Authentication of Named Entities (DANE, RFC 6698) addresses this problem, but must be supported by both parties.

That said, TLS is still useful with SMTP, because not using it makes MitM both easier and harder to detect. E.g., from the previous Received header you should be able to see whether the connection was encrypted or not, along with the cipher suite used.

1

Yes, you should, if you domain has DNSSEC you should probably deploy DANE also,

-1

Yes.

  1. It can't hurt.
  2. Let's Encrypt is free and takes minimal time to set up, especially if you're already using it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.