[Emailcore] Re: [Last-Call] Re: Re: Re: Your (Roman's) DISCUSS on draft-ietf-emailcore-as and status of the document

[Rob Sayre <[e-mail]>]

On Sun, Sep 20, 2026 at 10:41 AM John C Klensin <[e-mail]> wrote:

>
>
> --On Monday, September 21, 2026 02:00 +1000 Viktor Dukhovni
> <[e-mail]> wrote:
>
> > On Sun, Sep 20, 2026 at 11:05:37AM +0200, Eliot Lear wrote:
> >
> >> We are not the protocol police, and we have no army.  MUST is
> >> *practical* *advice* to deployments about how best to
> >> interoperate with others, in this case balanced against potential
> >> harm.  That balance has already been decided operationally by
> >> public deployments, [...]
> >>
> >> Moreover, I am one of but a very few people party to this
> >> discussion who is in a position to reject unencrypted SMTP
> >> transactions (of course I don't).  I know of nobody who does.
> >
> > I concur, but should perhaps concede that a small minority of
> > Postfix MTA operators have self-reported choosing (against
> > generally better advice) to reject non-TLS mail transactions.
> > Their MTA is "able to accept mail with or without confidentiality",
> > their "particular circumstances" apparently make rejecting
> > cleartext transactions an acceptable risk.
>
> Ok.  But what does it mean _for the document_ to "concede" that?
>

Just say less. The document does a good job describing the interoperability
concern in the paragraph above.

TLS can be a compliance requirement, and a great way to ensure compliance
is to use an SMTP server that doesn't support cleartext at all.

thanks,
Rob


Here are the Google Workspace settings:

You can reject non-TLS emails in Google Workspace by configuring a Secure
transport (TLS) compliance setting or requiring TLS on an inbound mail
gateway in the Google Admin Console.

How to Require TLS for Specific Senders or Domains:
Sign in to the Google Admin Console using an administrator account.
Go to Menu > Apps > Google Workspace > Gmail > Compliance.On the left,
select your target organizational unit.
Find Secure transport (TLS) compliance and click Configure (or Add another).
Enter a setting name, choose Inbound, Outbound, or both, and select or
create an address list for the domains/emails you want to enforce.
Check options like Require CA signed certificate and Validate certificate
hostname for robust security, then click Save.

How to Require TLS via an Inbound Gateway:
In the Google Admin Console, navigate to Apps > Google Workspace > Gmail >
Spam, phishing, and malware.
Select your organizational unit on the left, then scroll to Inbound gateway
and click Configure or Edit.
Enter your gateway's public IP address or range.
Check the box for Require TLS for connections to reject incoming connection
attempts that do not use TLS.