Tag

#tls

Transport security for mail. STARTTLS on port 587 upgrades a plaintext connection after the greeting; implicit TLS on 465 negotiates before any SMTP is exchanged. Both end up encrypted, but only 465 is encrypted from the first byte, which is why it is preferred where the client supports it. Threads here also cover certificate validation - opportunistic TLS between mail servers usually does not validate the certificate at all, which protects against passive capture but not against an active attacker.

0 discussions