13

I was testing my mail server's STARTTLS configuration when I stumbled onto this page : https://starttls.info/about. The following excerpt puzzles me:

When you send an email through your outgoing mail server, that email will potentially do multiple hops between different mail servers before reaching its destination. All of these intermediate servers will have to have strong STARTTLS support, in order for your message to not be exposed at one or more stages of its journey.

It was my understanding that the process of sending an e-mail was the following:

  1. The mail server performs a DNS lookup to get the recipient's domain name's MX.
  2. The mail server initiates a connection to the obtained IP on port 25 (SMTP).
  3. If both servers support opportunistic encryption, a secure connection is established.
  4. The e-mail is delivered to the recipient (EHLO, MAIL FROM:, RCPT TO:, DATA, .)

Now where in all this is there an opportunity for the e-mail to bounce around multiple servers?

Improve this question
1
  • 1
    Take a received email, look at the headers. Every "Received:" line shows a system that mail went through. There could be several systems on the same host (e.g. a spam filter or a virus scanner), mostly recognizable from the "localhost" address. But the rest will be all the hosts that handled that email. At least as far as they are RFC-compliant and leave one of those "Received:" headers.
    – Dubu
    Commented Apr 4, 2014 at 22:41

3 Answers 3

Reset to default
19

Mail regularly gets bounced around between servers. For example, if I send an email to a friend it might:

  • Go from my computer to my own mail server (hopefully encrypted)
  • My mail server sends it to it's smarthost, since it's configured not to send mail directly
  • The smarthost sends it to the MX record of the destintion domain, which happens to be a hosted spam filter
  • The spam filter tries to send it to the target's real mail server, but it's unreachable, so it uses the secondary MX, a hosted system that stores its email in case the real mail server is down.
  • Real mail server comes back up, the secondary MX sends the email to the target mail server.
  • My friends downloads his email from his mail server.

That's a fairly common configuration, and causes the email to bounce around 6 times. It eventually gets where it's going, but unless all those servers use STARTTLS or other encryption, at some points it will be unencrypted. Even with transport encryption, the admin of any of those servers could still read the email. It's stored unencrypted on their hard drives while it waits to be sent to the next stage.

There could easily be even more if my friend had his email set to forward somewhere else, which is common if your web hosting provider also does your email, and you forward it to your gmail account.

If you are concerned about people reading your email, the best thing to do is encrypt the message using something like GPG, not to rely on transport encryption. Of course, this requires that the person receiving the email also care enough to setup GPG and exchange keys.

Improve this answer
3
  • Thank you for your answer! Accepted for clarity (sorry TomTom, but yours was great too!). Nice touch pointing out that the e-mails get stored in plaintext on the intermediate servers: I don't see STARTTLS as anything other than a defense against passive eavesdropping.
    – Executifs
    Commented Apr 4, 2014 at 13:48
  • @Executifs no offense taken. That said: "statls as anything other" - a defense against passiv eavasdropping is critical. Both sides control pretty much all servers in between (send relays, receipient relays) but have no control over the wire medium. In today's times, where Obama and other officials read the emails of the whole world for breakfast news (daramatization) encrypting the way between the servers is super critical.
    – TomTom
    Commented Apr 5, 2014 at 15:33
  • @TomTom Sorry, it seems that my comment wasn't clear. I meant that to me, STARTTLS is mainly a defense against massive interception capabilities and not relay administrator's prying eyes (for which GPG would be a solution). So I agree with you completely on this.
    – Executifs
    Commented Apr 7, 2014 at 7:41
7

Try that: The server you send is not the one that it finishes. it is MY gateway server for incoming emails that is doing some nice anti spam stuff then forwarding it to the real server.

Gets even better. THe sending email server you use is not the one your company uses facing the internet. It does NOT do a DNS lookup but forwards all emails to a gateway server that THEN sends them to the final recipient. This is not a rare setup in larger organizations.

I maintaina system like that in which multiple network share a common gateway server for incoming and outgoing emails. Incoming emails are forwarded to one of multiple servers, depending on client.

On the incoming site it may also be that the real email server is down. MX can hanve backup entries - and in mose cases these will just buffer the email and then forward it again once the real server is available again.

Improve this answer
1
  • All of those things, plus aliases.
    – NickW
    Commented Apr 4, 2014 at 12:56
3

How you outlined it is pretty much how it works across the board.

There are still intermediate mail servers, but generally they are the public facing servers that your source server connects to. That server may relay the message to an internal server based on any number of rules, such as username, time, load, content(spam), etc.

I would hope that these organizations or third party providers support the same features throughout. Your mail should not transit through a mail server that is unknown to the source or destination, as all intermediaries should be owned or managed by a trusted party.

Improve this answer
4
  • That last sentence isn't even close to true; try dig mx insolvency.gsi.gov.uk for one of myriad examples of mail routing through servers owned by neither source nor destination organisation. Or mail to any of the legion domains who have their mail handled by gmail.
    – MadHatter
    Commented Apr 4, 2014 at 13:45
  • 2
    You are correct. I phrased that poorly, and was intending to say that the mail shouldn't be routed through an unknown third party mail server while in transit to the final destination. That any intermediate mail servers if not owned by the source or destination, are at least known and managed by a trusted party. I've edited the answer, thanks for clarification.
    – David Houde
    Commented Apr 4, 2014 at 14:04
  • What you've got now is a lot closer to how I believe it all to work, so I've removed my downvote.
    – MadHatter
    Commented Apr 4, 2014 at 14:50
  • To add to @MadHatter's comment, someone using such an external mail service can also forget about impementing several other security features (such as SPF).
    – Hagen von Eitzen
    Commented Apr 5, 2014 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .