By "by ok to use" I mean:

  • are MTA agents receiving emails from my server going to reject my email
  • if not, are they going to make other kind of bad treatment for my emails (marking as spam, unsafe and so...)?

...or is it just better idea to stick with non-encrypted emails?


I ran an MTA with a self-signed certificate for a couple of years, until real ones got cheap enough that I could no longer be bothered to do so, and I didn't have a single rejection because of the unsigned certificate in all that time. I never had a single complaint about a mail being marked as spam because of it, either; if anything, using TLS often seems to mark you out as a non-spamming professional.

In my opinion, it is definitely worth enabling SMTP TLS if you can, whether or not you pay for a third-party-signed certificate.

Edit in response to your comment: It's not that someone couldn't choose to restrict inbound mail on that basis; I've never come across it, is all. A third-party-signed certificate is still useful to prove there is no man-in-the-middle attack happening; but that doesn't seem to be a serious problem in the MTA world at this time. If that starts to change, we could well find that people start to insist on signed certificates.

Security exists to address threats, so if the threat model changes, the range of sane and proportionate security responses will change with it.

  • Thank you. That I didn't know: that there is no restrictive treatment of self-signed certificates in MTA to MTA traffic, unlike other cases. But, what is real (CA-signed) certs useful for if we can relay on our self-signed? – Miloš Đakonović Mar 1 '14 at 8:06
  • Agree 100%. I've never encountered a recipient daemon that wanted to verify my key. And since I'm ready to give to anybody with an MX, I don't care about theirs. This will change. – quadruplebucky Mar 1 '14 at 13:28
  • 1
    I still run an MTA with self-signed certificates. It seems to be quite common. – Michael Hampton Mar 1 '14 at 14:00
  • How does using TLS relate to marking as spam? I would assume it is about identifying the receiving end, unless the sender is using its cert in the encrypted connection. Also in what percentage did the sender choose to try TLS at all rather than sending it in the clear? – hultqvist Mar 2 '14 at 20:35

Like MadHatter said, at the moment encryption using a self-signed certificate is actually a step up in comparison to many other small time SMTPs if you are talking SMTP-relaying.

There are a few drawbacks, however, but not of the kind you expect. The most important one being your SMTP-clients choking on encryption. There are many small SMTP-clients deployed in off-the-shelf solutions for common business problems that don't like SMTP encryption and fail -- often silently! So, if you are using standard software with built-in mail clients, check them before you switch.

Other than that I'd say, if you are concernced about your mail being marked as spam, consider setting up SPF and DKIM. That helps very much.

  • "setting up SPF and DKIM" -- I couldn't agree more. Yahoo and Hotmail, IIRC, by default places emails in the Spam/Junk folder if neither option is set. – pepoluan Mar 1 '14 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.