Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email encryption is here – use STARTTLS everywhere

dwheeler.com

Post reply on HN
Print view View original

51–60 of 74 posts

Re: Email encryption is here – use STARTTLS everywhere

#51

Post by laumars »

Erlich_Bachman wrote: post #37
selectodude wrote: post #20

Earlier quoted context omitted.

Also all of your emails get kicked to spam when you host your own.

Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. But you can easily host your e-mail server on a real datacenter server or something similar, and you'll have almost no problems with spam filtering. (In fact many companies and even individuals already do this and have done this for long time.)

> Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters.

As are many cloud hosts / VPSs. AWS, OVH, Digital Ocean, etc I've heard plenty of horror stories from people trying to run mail servers on all kinds of cloud platforms (and personally experienced issues on EC2 instances myself)

Re: Email encryption is here – use STARTTLS everywhere

#52

Post by walrus01 »

sleavey wrote: post #49
walrus01 wrote: post #47

Earlier quoted context omitted.

At present not allowing plaintext port 25 will break a lot of email functionality, there are a ton of old and poorly set up mx out there. I have my postfix setup as "may" for TLS, not required.

But for actively maintained servers, could they not be configured to support TLS for clients that request it without breaking plaintext email for old clients? I'm trying to understand whether supporting old clients really means not supporting encryption features for up-to-date clients.

I was referring to server-to-server mail exchange.

Yes, this is how my server is. When exchanging smtp with another domain's mx, if that other smtpd will not do TLS, it sends plaintext mail. For clients submitting mail via smtp with auth, such as thunderbird on my desktop PC, of course it does TLS1.2.

Re: Email encryption is here – use STARTTLS everywhere

#53

Post by mrb »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

I don't think you read or understood what I wrote. You were not routing through a smart host (third party SMTP relay.) This is your problem.

There is a specific reason I recommend doing so: the reputation of the sending IP address almost always overrides the reputation of the sending domain.

A smart host operated by a third party, such as Google: https://support.google.com/a/answer/2956491?hl=en , would have solved your blackholing issues because it's the third party's job to maintain extremely good reputation of their IPs sending mail. Most importantly, they have high volume of legit emails, and volume is key to maintain good reputation. Finally, even if you have a low-volume domain, your emails will benefit of the good rep of the smart host, and thus would not be blackholed.

I will repeat it again: if you host your mail server, you definitely should also use a smart host, and all the spam/blackholing issues disappear.

Re: Email encryption is here – use STARTTLS everywhere

#54

Post by CyberShadow »

mrb wrote: post #53
techsupporter wrote: post #39

Earlier quoted context omitted.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

I don't think you read or understood what I wrote. You were not routing through a smart host (third party SMTP relay.) This is your problem. There is a specific reason I recommend doing so: the reputation of the sending IP address almost always overrides the reputation of the sending domain. A smart host operated by a third party, such as Google: https://support.google.com/a/answer/2956491?hl=en , would have solved y…

Using Gmail as a smart host defeats the point as mentioned in the root comment of this thread: Google can read your email.

Google also rewrites the "From:" address to your Google account's address, unless you jump through some hoops to add it to your account. This has become more difficult recently, and needs to be done for every address (which is an issue if you use single-purpose email addresses).

Re: Email encryption is here – use STARTTLS everywhere

#55

Post by conquistadog »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

"Worse, the destination would say '250 OK' to every e-mail I sent them so I had no way of knowing that the messages had been sent to the big bitbucket in the sky. I got annoyed"

This. I go to a lot of trouble to follow all relevant RFCs, SPF, DKIM, DMARC, and TLS. My intent is to help other servers know I'm transmitting in good faith, I'm hopes I'll get the same fair shake.

If it's still not good enough for you, please at least let me know that fact, with a message I can investigate. At the very least, don't outright lie, which is what I take a bogus 250 to be doing.

Re: Email encryption is here – use STARTTLS everywhere

#56

Post by GordonS »

laumars wrote: post #35
arpa wrote: post #8

Earlier quoted context omitted.

I am my own provider. It's really not that hard to configure a mail server. Other peoples' providers, however... so I tried using PGP. It's somehow manages to be more difficult to use than configuring and running your own mailsystem which doesn't deliver straight to gmails' spam folder, but I digress; but then my emails are at mercy of the end devices: who knows if outlook doesn't send a plaintext email home as "tele…

> I am my own provider. It's really not that hard to configure a mail server. Oh yes it is. I mean for professional sysadmins it may not be, but try talking any normal person through buying a domain, getting an SSL certificate, attaching that at your MTA, configuring all those fiddly DNS records that prove you're emails are who you say you are. And all of that isn't even taking into account how needlessly painful the…

I consider myself very technical, and know my way around Windows and Linux pretty well (I've used both for many years), but setting up a mail server is something I do very infrequently and find complicated to get right when I do so, especially when getting it working with TLS, DKIM, SPF and spam filtering.

Re: Email encryption is here – use STARTTLS everywhere

#57

Post by mike-cardwell »

drudru11 wrote: post #21

It would be better to have a TLS connection right at the start. STARTTLS is less secure. Why hasn't this happened for SMTP?

Because it's not backwards compatible, and would prevent delivery of a large amount of email.

We just need a way for domain owners to signal that their domains definitely accept email over STARTTLS. At that point, senders which recognise those signals can start to enforce that mail which they send to those domains MUST use STARTTLS. Fortunately, those signalling methods are beginning to rise to the surface. We have MTA-STS, and now also a preload list thanks to StartTLS Everywhere.

Re: Email encryption is here – use STARTTLS everywhere

#58

Post by yrro »

loup-vaillant wrote: post #50
Erlich_Bachman wrote: post #37

Earlier quoted context omitted.

Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. But you can easily host your e-mail server on a real datacenter server or something similar, and you'll have almost no problems with spam filtering. (In fact many companies and even individuals already do this and have done this for long time.)

> Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. This is pretty much what "hosting your own" really means. Having SSH access to some virtual machine somewhere is much better than letting gmail read all your mail, but it's still isn't self hosting. You could still use the remote host as a mere relay, but it'…

Host at home, relay via an IP address owned by a hosting provider. Pragmatism meets idealism.

Of course, I don't do this because I don't want to rely on my consumer internet connection or domestic electricity provider, and my flat is too small for a rack anyway. Also the noise, electricity bills and waste heat play a part.

Some things are best done centrally. I am happy with servers in the cloud, I really don't miss having to travel half way across the country to replace a hard drive...

Re: Email encryption is here – use STARTTLS everywhere

#59

Post by loup-vaillant »

yrro wrote: post #58
loup-vaillant wrote: post #50

Earlier quoted context omitted.

> Not true. This might be happening if you are trying to host a server on your domestic internet connection, those IP ranges are usually banned in spam filters. This is pretty much what "hosting your own" really means. Having SSH access to some virtual machine somewhere is much better than letting gmail read all your mail, but it's still isn't self hosting. You could still use the remote host as a mere relay, but it'…

Host at home, relay via an IP address owned by a hosting provider. Pragmatism meets idealism. Of course, I don't do this because I don't want to rely on my consumer internet connection or domestic electricity provider, and my flat is too small for a rack anyway. Also the noise, electricity bills and waste heat play a part. Some things are best done centrally. I am happy with servers in the cloud, I really don't miss…

> Host at home, relay via an IP address owned by a hosting provider.

As I said, "You could still use the remote host as a mere relay, but it's still not ideal". And by the way, as much as I'd like to host my email at home, I still gave in somewhat and use a remote virtual machine (at https://gandi.net).

> my flat is too small for a rack anyway. Also the noise, electricity bills and waste heat play a part.

You need less than 5W, a small shoe box worth of space, and no fan at all to host your email at home. R-Pi, Sheeva plug… A web site with moderate traffic might be more problematic. But we're nowhere near a rack. For remote hosting, you don't need more than a fraction of a CPU core.

Reliability, though, that can be a real problem. And a big reason why I still use my virtual hosting provider. I'd love a redundant setup, where if something goes down, the backup takes over, and notifies you about needing to replace a piece of hardware. (Of course, it should be plug & play so my grandma could do it… one can dream.)

Re: Email encryption is here – use STARTTLS everywhere

#60

Post by [deleted] »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

[deleted]
Post reply on HN