[Email] - Enforce TLS for postfix #798

New Issue

Closed

opened 2024-02-22 10:24:18 +01:00 by muppeth · 1 comment

muppeth commented

2024-02-22 10:24:18 +01:00

Owner

According to postfix documentation

You can ENFORCE the use of TLS, so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption, by setting "smtpd_tls_security_level = encrypt". According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced Postfix SMTP server. This option is off by default and should only seldom be used.

That basically means in order to ensure mail delivery non-tls connections should be allowed. "Usuário" on xmpp muc has raised an interesting point and I wonder.
🤔 In 2024 who does not use tls on their server except for spammers? Perhaps we could enforce it? We should dig deeper and weight all the pros and cons of a switch. This is not critical so we have enough time to debate, research and make a decission

According to [postfix documentation](https://www.postfix.org/TLS_README.html) > You can ENFORCE the use of TLS, so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption, by setting "smtpd_tls_security_level = encrypt". According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced Postfix SMTP server. This option is off by default and should only seldom be used. That basically means in order to ensure mail delivery non-tls connections should be allowed. *"Usuário"* on xmpp muc has raised an interesting point and I wonder. 🤔 In 2024 who does not use tls on their server except for spammers? Perhaps we could enforce it? We should dig deeper and weight all the pros and cons of a switch. This is not critical so we have enough time to debate, research and make a decission

muppeth added the

Discussion

Mail

labels 2024-02-22 10:24:18 +01:00

muppeth commented

2024-02-22 12:49:58 +01:00

Author

Owner

Ok. My bed here.
Recently we have switched to DANE for smtp_tls_security_level #755
As per documentation, postfix uses mandatory TLS when TLSA record is found for the server, and if not it falls back to opportunistic TLS. This solution is the best imo as it pushes the adoption of DANE.
So this could be closed unless anyone has any more imput.

More info:
https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md

Ok. My bed here. Recently we have switched to DANE for smtp_tls_security_level #755 As per documentation, postfix uses mandatory TLS when TLSA record is found for the server, and if not it falls back to opportunistic TLS. This solution is the best imo as it pushes the adoption of DANE. So this could be closed unless anyone has any more imput. More info: https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md

👍 1

muppeth closed this issue

2024-02-24 23:48:02 +01:00