You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The SMTP STARTTLS option, used in negotiating transport-level
encryption of SMTP connections, is not as useful from a security
standpoint as it might be because of its opportunistic nature;
message delivery is, by default, prioritized over security. This
document describes an SMTP service extension, REQUIRETLS, and message
header field, TLS-Required. If the REQUIRETLS option or TLS-Required
message header field is used when sending a message, it asserts a
request on the part of the message sender to override the default
negotiation of TLS, either by requiring that TLS be negotiated when
the message is relayed, or by requesting that recipient-side policy
mechanisms such as MTA-STS and DANE be ignored when relaying a
message for which security is unimportant.
This commit does not enable support for SMTPUTF8 (we are not conformant
to RFC 6531 yet, #165) nor for REQUIRETLS (more changes are needed to
implement it correctly, #123).
It just fixes code to account for backward-incompatible changes and adds
a new field to MsgMetadata to store MAIL FROM arguments in.
Dropping from 0.1 milestone, extension is not really worth adopting this early since underlying protocols (MTA-STS, DANE, DNSSEC) are not widely adopted either yet and other major implementations have no plans on implementing REQUIRETLS.
Abstract (copied from specification)
Specification
IETF I-D: https://tools.ietf.org/html/draft-ietf-uta-smtp-require-tls-09
The text was updated successfully, but these errors were encountered: