IETF Logo Mail Archive

Re: [ietf-smtp] How to encrypt SMTP?

Viktor Dukhovni <ietf-dane@dukhovni.org> Sun, 27 October 2019 08:01 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: ietf-smtp@ietfa.amsl.com
Delivered-To: ietf-smtp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24C7A120114 for <ietf-smtp@ietfa.amsl.com>; Sun, 27 Oct 2019 01:01:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.199
X-Spam-Level:
X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t9C4OSGKj3hO for <ietf-smtp@ietfa.amsl.com>; Sun, 27 Oct 2019 01:01:42 -0700 (PDT)
Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7C98120111 for <ietf-smtp@ietf.org>; Sun, 27 Oct 2019 01:01:41 -0700 (PDT)
Received: from [10.105.159.102] (unknown [88.128.80.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 68AB32C3E56 for <ietf-smtp@ietf.org>; Sun, 27 Oct 2019 04:01:40 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <alpine.OSX.2.21.99999.368.1910262041440.10592@ary.qy>
Date: Sun, 27 Oct 2019 09:01:36 +0100
Content-Transfer-Encoding: quoted-printable
Reply-To: ietf-smtp@ietf.org
Message-Id: <89FA8C9B-1205-4439-9773-7E366A3FBEBF@dukhovni.org>
References: <20191027002554.260ABD7437F@ary.qy> <344aaf1f-df91-ffb9-38bc-527d159a2ca6@network-heretics.com> <alpine.OSX.2.21.99999.368.1910262041440.10592@ary.qy>
To: ietf-smtp@ietf.org
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-smtp/vmaMJbHLjd48kppFl3Opnn2tO40>
Subject: Re: [ietf-smtp] How to encrypt SMTP?
X-BeenThere: ietf-smtp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Discussion of issues related to Simple Mail Transfer Protocol \(SMTP\) \[RFC 821, RFC 2821, RFC 5321\]" <ietf-smtp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf-smtp/>
List-Post: <mailto:ietf-smtp@ietf.org>
List-Help: <mailto:ietf-smtp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf-smtp>, <mailto:ietf-smtp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Oct 2019 08:01:44 -0000

> On Oct 27, 2019, at 2:47 AM, John R Levine <johnl@taugh.com> wrote:
> 
> I believe it's the same reason that Google doesn't sign their domains with DNSSEC.

Google have signed *some* of their domains with DNSSEC, in particular:

	mx[1-4].smtp.goog

are signed, and are equally valid MX hosts for Gmail and other domains,
you'll even find these names in the presented certificate.  What they've
not as yet been able to do is sign google.com, I'm inclined to speculate
that this is related to complications getting the DNS load-balancers to do
DNSSEC.

> They certainly could if they wanted to.

Yes, see above, but DNSSEC for "google.com" is likely to take more time.

-- 
	Viktor.

v2.23.0 | Report a Bug | By Email