Re:STARTTLS Everywhere
by znpy on Tuesday June 26, 2018 @05:59AM
(#17399218)
This is interesting, I have been wondering for a while if I could disable plaintext email delivery on port 25 and just leave encrypted submission on port 465.. Would I be losing mail ?
[ Parent
| on HN ]
Yes, unfortunately you'd be losing email. Port 465 has been deprecated a while back (1997).
I guess that's the problem - there is no practical way to disable plaintext email from the start. You may always need to accept the connection, see if the client will STARTTLS, disconnect if they do not and hope they don't re-try and keep hammering your servers with the same message, the error message "hey, i'm not accepting plaintext" will most likely get ignored.
Gmail says 89% of inbound email is encrypted (up from 60% 2 years ago). So theoretically you'd lose 11% of your mail. https://transparencyreport.google.com/safer-email/overview?h...