Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email encryption is here – use STARTTLS everywhere

dwheeler.com

Post reply on HN
Print view View original

41–50 of 74 posts

Re: Email encryption is here – use STARTTLS everywhere

#41

Post by techsupporter »

arpa wrote: post #22
CyberShadow wrote: post #17

Earlier quoted context omitted.

This is just not true. The Internet is full of stories of people having trouble with large email providers (notably Google and Microsoft) accepting self-hosted users' mail. A self-hosted setup's IP starts with 0 reputation (or worse, depending on who owned the IP address beforehand) and will face throttling and outright blocking for a painful amount of time. Furthermore, if you forward your email to e.g. a Gmail inbo…

Point 1: spf, dkim, dmarc is enough to get yourself neutral with gmail. You have to do it from get-go tho, before you tarnish your reputation. Being in DNSBL lists does not help either. Set up proper reverse dns entries also. Tls is completely optional. Haven't had any trouble neither with gmail nor ms using both residential and datacenter ips in two EU countries. I don't consider myself a hardcore linux admin specia…

Counterpoint 1: I wrote my rant as a separate reply but the summary is that after twenty years of running my own e-mail and doing everything "right," I still got regularly binned by Google and Microsoft and (rarely) Yahoo, so I gave it up and switched to Fastmail. My experience, according to chats with others in my field, is not unique. I'd actually go so far to say that yours, with reliable delivery to Gmail with a small server, is the outlier.

https://news.ycombinator.com/item?id=17632081

Re: Email encryption is here – use STARTTLS everywhere

#42

Post by wastholm »

Erlich_Bachman wrote: post #37
selectodude wrote: post #20

Earlier quoted context omitted.

Also all of your emails get kicked to spam when you host your own.

Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. But you can easily host your e-mail server on a real datacenter server or something similar, and you'll have almost no problems with spam filtering. (In fact many companies and even individuals already do this and have done this for long time.)

Honest question: Where do people get this idea that they state so confidently, that it's "impossible" to run one's own mail server? Have they actually tried or are they just repeating what they've heard?

Counter-anecdote: I have run my own mail server for several years. I use it for all my email communication, and also send out daily emails to a couple of thousand subscribers[1] who are on all sorts of email providers. The "canary accounts" I have set up on all the big providers all seem to have their subscription messages delivered straight to the inbox just fine, though I should probably monitor this better somehow.

[1] the Aphorism of the Day, https://www.aphorismsgalore.com/

Re: Email encryption is here – use STARTTLS everywhere

#43

Post by zAy0LfpBZLC8mAC »

walrus01 wrote: post #38
zAy0LfpBZLC8mAC wrote: post #36

Earlier quoted context omitted.

> The easiest way is just having the sudo ability to temporarily open port 80 for the challenge/response process. The easiest way is to forget about HTTP and use DNS verification. Just create a dynamically updateable TXT record in your zone that the LE client can update and then point CNAMEs for the names that you want to create certificates for to that TXT record.

I am too paranoid and untrusting to give the LE automated tool the ability to edit DNS zonefiles. My DNS setup is quite far removed logically from the mail server setup, intentionally.

You don't need to "edit zonefiles", and whether it's "logically removed" is kinda irrelevant?

You simply set up a dynamically updateable zone and then have the LE client call nsupdate, it couldn't be any easier, you don't even need sudo.

You could also delegate DNS for your MX to the MX itself, of course, then you'd have pretty much the same setup as with the HTTP server on the MX, just using a DNS server instead. But that's just too complicated, really, using dynamic DNS is flexible and allows you to easily add other services that need certificates on any machine whatsoever with no need to have an HTTP (or any other) server running on the machine reachable from the outside.

Re: Email encryption is here – use STARTTLS everywhere

#44

Post by AndyMcConachie »

For folks interested in this subject I highly recommend Viktor Dukhovni's talk he gave at ICANN 61 on SMTP STARTTLS/DANE.

https://mail.sys4.de/pipermail/dane-users/2018-March/000445....

He also runs stats every month on DANE adoption.

https://mail.sys4.de/pipermail/dane-users/2018-June/000460.h...

Re: Email encryption is here – use STARTTLS everywhere

#45

Post by sleavey »

I have my mail server require a TLS connection to a host before sending mail, but perhaps 2% of the time I get my mail bounced by the target server because it doesn't support it, including my old university. It's really crazy that a 20+ year old, standard technology is not literally everywhere, especially in big organisations.

Incidentally, that same university in the past year started injecting footers into people's emails, so I guess their primary focus is neither privacy nor security.

Re: Email encryption is here – use STARTTLS everywhere

#46

Post by walrus01 »

I really can't agree with this part:

> The STARTTLS Everywhere project has created a “STARTTLS Policy List” where supporting organizations can assert that they always use STARTTLS using a valid certificate. Organizations should join that list and check that list before they send email.

We don't need a new separate place to publish the TLS ability of our mx. This can be done with a txt record in the DNS zonefiles same as spf.

It would need some sort of consistent rfc-guided format for what TLS policy re: downgrades, port 25 plaintext, etc, that you want to publish.

Not too dissimilar from publishing an HSTS policy, but done by the authoritative nameservers for a zone rather than on an individual httpd.

Re: Email encryption is here – use STARTTLS everywhere

#47

Post by walrus01 »

sleavey wrote: post #45

I have my mail server require a TLS connection to a host before sending mail, but perhaps 2% of the time I get my mail bounced by the target server because it doesn't support it, including my old university. It's really crazy that a 20+ year old, standard technology is not literally everywhere, especially in big organisations. Incidentally, that same university in the past year started injecting footers into people's…

At present not allowing plaintext port 25 will break a lot of email functionality, there are a ton of old and poorly set up mx out there. I have my postfix setup as "may" for TLS, not required.

Re: Email encryption is here – use STARTTLS everywhere

#48

Post by walrus01 »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

I wish I could upvote you more than once. No matter how perfectly your mx environment is set up, the IP space internal reputation tools run by Google and MS for office365 will remain totally opaque. I have this issue occasionally with o365 hosted destination smtp, and I control my own ASN and ARIN IP space. Not once in the history of mankind has an open relay run on my IP space, nor has spam come from it.

Re: Email encryption is here – use STARTTLS everywhere

#49

Post by sleavey »

walrus01 wrote: post #47
sleavey wrote: post #45

I have my mail server require a TLS connection to a host before sending mail, but perhaps 2% of the time I get my mail bounced by the target server because it doesn't support it, including my old university. It's really crazy that a 20+ year old, standard technology is not literally everywhere, especially in big organisations. Incidentally, that same university in the past year started injecting footers into people's…

At present not allowing plaintext port 25 will break a lot of email functionality, there are a ton of old and poorly set up mx out there. I have my postfix setup as "may" for TLS, not required.

But for actively maintained servers, could they not be configured to support TLS for clients that request it without breaking plaintext email for old clients? I'm trying to understand whether supporting old clients really means not supporting encryption features for up-to-date clients.

Re: Email encryption is here – use STARTTLS everywhere

#50

Post by loup-vaillant »

Erlich_Bachman wrote: post #37
selectodude wrote: post #20

Earlier quoted context omitted.

Also all of your emails get kicked to spam when you host your own.

Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. But you can easily host your e-mail server on a real datacenter server or something similar, and you'll have almost no problems with spam filtering. (In fact many companies and even individuals already do this and have done this for long time.)

> Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters.

This is pretty much what "hosting your own" really means. Having SSH access to some virtual machine somewhere is much better than letting gmail read all your mail, but it's still isn't self hosting. You could still use the remote host as a mere relay, but it's still not ideal.

Real self hosting means having your box at home, sending and receiving mail directly. And that is effectively impossible. Self hosting is dead. I'm not sure how we could resurrect it.

Post reply on HN