Re: [Emailcore] Issue 80 - Clarify where the protocol stands with respect to submission and TLS issues

If I may,  I wish to add an implementation antidote note. In our ongoing battle to control SMTP attacks, we recently updated our SMTP server to required TLS for AUTH.   In other words,  AUTH is not presented in initial EHLO response if the session is not encrypted (by issuing STARTTLS first). So far, session trace logs show it has made a difference, albeit small, a difference nonetheless.    I do wonder how other SMTP servers behave.  It may depend on SASL methods available (plain text vs encrypted).

All the best,
Hector Santos

> On Nov 30, 2023, at 3:14 PM, Todd Herr <todd.herr=40valimail.com@dmarc.ietf.org> wrote:
> 
> Greetings.
> 
> The subject issue (https://github.com/ietf-wg-emailcore/emailcore/issues/80) was discussed during the 29 November 2023 interim. The initial comments from November 2022 in the Github issue read as follows:
> 
> submission on port 587
> submission on port 465
> TLS relay on a port different from 25 (whenever)
> Recommendations about general use of transport layer (hop by hop)
> security, particularly encryption including consideration of RFC
> 8314.
> The MTA-to-MTA relay case is now covered by now closed ticket #54 <https://github.com/ietf-wg-emailcore/emailcore/issues/54>. Do we need to say anything about submission and RFC 8314?
> 
> The conversation at the interim seemed to coalesce around the idea that section 6 of the current version of the A/S (https://www.ietf.org/archive/id/draft-ietf-emailcore-as-08.html#name-confidentiality-and-authent) addresses this topic save for no mention of port 465. 
> 
> It is recorded in the comments for this issue that the A/S should be updated to acknowledge the existence of port 465 and the ticket should be closed. Specifically, this sentence in section 6.4:
> 
> SMTP AUTH defines a method for a client to identify itself to a Message Submission Agent (MSA) when presenting a message for transmission, usually using port 587 rather than the traditional port 25.
> 
> should be updated to read as follows:
> 
> SMTP AUTH defines a method for a client to identify itself to a Message Submission Agent (MSA) when presenting a message for transmission, usually using ports 465 or 587 rather than the traditional port 25.
> 
> Please consider what was recorded from the interim and either declare your support for making this change to the A/S and closing this issue or provide candidate text for insertion into the next revision of the A/S.
> 
> Thank you.
> 
> -- 
> Todd Herr  | Technical Director, Standards & Ecosystem
> e: todd.herr@valimail.com <mailto:todd.herr@valimail.com>
> p: 703-220-4153
> m: 703.220.4153
> 
> This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.
> -- 
> Emailcore mailing list
> Emailcore@ietf.org
> https://www.ietf.org/mailman/listinfo/emailcore