Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email encryption is here – use STARTTLS everywhere

dwheeler.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Email encryption is here – use STARTTLS everywhere

#61

Post by kilburn »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

> The volume of mail going out of my server was so low, I could read the outbound mail.log for myself, and routinely did.

This was your actual problem. The large providers (gmail, outlook, yahoo) and appliance vendors (ironport, etc.) are all now treating "unknown" senders as spammers. If you don't send a large enough volume of emails, you will never make it into their reputation tracking lists because "it's not worth it". End result, you are considered unknown and will be treated as a spammer forever.

It is a huge organically grown cartel where the protocols work but you cannot enter a small player, no matter how well you behave. It is a shame, but there's nothing you can do about it :(

Re: Email encryption is here – use STARTTLS everywhere

#62

Post by amaccuish »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

I agree this doesn't sound nice, but for years before "cloud", most orgs had exchange servers and we rarely had this problem. I think it's still possible to self-host.

Re: Email encryption is here – use STARTTLS everywhere

#63

Post by mrb »

CyberShadow wrote: post #54
mrb wrote: post #53

Earlier quoted context omitted.

I don't think you read or understood what I wrote. You were not routing through a smart host (third party SMTP relay.) This is your problem. There is a specific reason I recommend doing so: the reputation of the sending IP address almost always overrides the reputation of the sending domain. A smart host operated by a third party, such as Google: https://support.google.com/a/answer/2956491?hl=en , would have solved y…

Using Gmail as a smart host defeats the point as mentioned in the root comment of this thread: Google can read your email. Google also rewrites the "From:" address to your Google account's address, unless you jump through some hoops to add it to your account. This has become more difficult recently, and needs to be done for every address (which is an issue if you use single-purpose email addresses).

«Using Gmail as a smart host defeats the point as mentioned in the root comment of this thread: Google can read your email.»

Many things wrong with this sentence:

• Don't like Google? Then use any of the hundreds of other smart host relays: Sendgrid, OutboundSMTP, etc

• The smart host can't read your incoming mail (typically more sensitive than outgoing.)

• Google, being a mail provider, can usually read your email anyway, because all your conversations with Gmail users end up in Google's hands.

«Google also rewrites the "From:"»

Google has multiple smart hosts offerings, but the one I linked to does NOT rewrite the From:.

Re: Email encryption is here – use STARTTLS everywhere

#64

Post by drudru11 »

mike-cardwell wrote: post #57
drudru11 wrote: post #21

It would be better to have a TLS connection right at the start. STARTTLS is less secure. Why hasn't this happened for SMTP?

Because it's not backwards compatible, and would prevent delivery of a large amount of email. We just need a way for domain owners to signal that their domains definitely accept email over STARTTLS. At that point, senders which recognise those signals can start to enforce that mail which they send to those domains MUST use STARTTLS. Fortunately, those signalling methods are beginning to rise to the surface. We have M…

All you need is another port in addition to the regular SMTP port. They are not mutually exclusive.

Re: Email encryption is here – use STARTTLS everywhere

#66

Post by Yetanfou »

selectodude wrote: post #20
arpa wrote: post #8

Earlier quoted context omitted.

I am my own provider. It's really not that hard to configure a mail server. Other peoples' providers, however... so I tried using PGP. It's somehow manages to be more difficult to use than configuring and running your own mailsystem which doesn't deliver straight to gmails' spam folder, but I digress; but then my emails are at mercy of the end devices: who knows if outlook doesn't send a plaintext email home as "tele…

Also all of your emails get kicked to spam when you host your own.

Not if you send your mail through a smart host (an outgoing SMTP proxy) which is in good standing. Most sane ISPs/IAPs require this anyway. I've hosted my own mail server since about 1996, moving from Sendmail on a 66MHz Pentium hanging off a cable internet connection to the current Exim on an Intel SS4200 on gigabit fiber - none of it high-powered hardware as such is not needed for the purpose. Mail sent from here arrives just fine, no problems there.

Re: Email encryption is here – use STARTTLS everywhere

#67

Post by jlgaddis »

__david__ wrote: post #19

So I support more encryption everywhere, but this is acting like there's something new? I know I've been using STARTLS on SMTP for almost 20 years… Am I missing something?

> ... there's something new?

The "STARTTLS Everywhere" project [0] -- the one thing this entire article is talking about -- is what's new.

> ... I've been using STARTLS on SMTP for almost 20 years ...

That's great -- I have too -- but I have some bad news for you: not everybody else has been! (I know, right!?)

The EFF is simply trying to bang the drums to get everyone's attention and then convince those that aren't already using STARTTLS (everywhere, hence the name) to consider doing so.

The good news, for you, is that you're already done. There's nothing for you to do, unless you want to add your domains to the "policy list" so that others who are participating won't send mail to you unless encryption is in use.

Fortunately, the EFF has already written about this extensively [0], so there's no need for me to rehash all the details (coincidentally, that same exact web page is also reachable by clicking on the first link in this article).

[0]: https://www.starttls-everywhere.org

Re: Email encryption is here – use STARTTLS everywhere

#68

Post by jlgaddis »

AndyMcConachie wrote: post #44

For folks interested in this subject I highly recommend Viktor Dukhovni's talk he gave at ICANN 61 on SMTP STARTTLS/DANE. https://mail.sys4.de/pipermail/dane-users/2018-March/000445.... He also runs stats every month on DANE adoption. https://mail.sys4.de/pipermail/dane-users/2018-June/000460.h...

Unfortunately, DANE relies on DNSSEC, and that's the biggest barrier to widespread adoption that DANE has.

Re: Email encryption is here – use STARTTLS everywhere

#69

Post by arpa »

laumars wrote: post #35
arpa wrote: post #8

Earlier quoted context omitted.

I am my own provider. It's really not that hard to configure a mail server. Other peoples' providers, however... so I tried using PGP. It's somehow manages to be more difficult to use than configuring and running your own mailsystem which doesn't deliver straight to gmails' spam folder, but I digress; but then my emails are at mercy of the end devices: who knows if outlook doesn't send a plaintext email home as "tele…

> I am my own provider. It's really not that hard to configure a mail server. Oh yes it is. I mean for professional sysadmins it may not be, but try talking any normal person through buying a domain, getting an SSL certificate, attaching that at your MTA, configuring all those fiddly DNS records that prove you're emails are who you say you are. And all of that isn't even taking into account how needlessly painful the…

And this is how the world ends, not with a bang, but with a whimper.

Re: Email encryption is here – use STARTTLS everywhere

#70

Post by apple4ever »

techsupporter wrote: post #39
mrb wrote: post #24

Earlier quoted context omitted.

You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.

No, in my experience, selectodude is right. I've written this rant before but I think it's worth sharing repeatedly, so here goes again: The big players (Google, in particular...in case it's not clear, the bulk of this rant is leveled at Google; Microsoft is an offender on perhaps 25% of the level, Yahoo just doesn't seem to care) have ZERO interest in "playing nice" with small e-mail servers. My experience running m…

I’ve been hosting my own email for years, and never had this problem.
Post reply on HN