IETF Logo Mail Archive

Re: [Uta] SMTP Over TLS on Port 26 - Implicit TLS Proposal

Alice Wonder <alice@domblogger.net> Sun, 06 January 2019 00:56 UTC

Return-Path: <alice@domblogger.net>
X-Original-To: uta@ietfa.amsl.com
Delivered-To: uta@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55F90130ED9 for <uta@ietfa.amsl.com>; Sat, 5 Jan 2019 16:56:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=domblogger.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dFy1mMs6QndQ for <uta@ietfa.amsl.com>; Sat, 5 Jan 2019 16:56:04 -0800 (PST)
Received: from mail.domblogger.net (mail.domblogger.net [104.200.18.67]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7613130ED4 for <uta@ietf.org>; Sat, 5 Jan 2019 16:56:03 -0800 (PST)
Received: from localhost.localdomain (c-73-15-182-232.hsd1.ca.comcast.net [73.15.182.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.domblogger.net (Postfix) with ESMTPSA id D0C2C11F7 for <uta@ietf.org>; Sun, 6 Jan 2019 00:56:01 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.domblogger.net D0C2C11F7
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=domblogger.net; s=default2019; t=1546736163; bh=nleMgDVRCVFqd0tWnPSYqmkuQ9hsIuvQcnIRGRyrmvE=; h=Subject:To:References:From:Date:In-Reply-To:From; b=kHdyULiHN4mHSbWoEEF2Bhwrzpi3A3kXAy/UAviLviYwDKAcIoayEp0WDo70IAV3W PDwTpBcu5mfIg3TbD/Dh6YEtinbL82mdfptaipaNOtKjxsMfoe5QGdmGQG8V5V2ozM qH7ltmt8WhwfviNVI1DWvy/iaIT7U26jj76fV/nXTa806sTaSVs8ySPtJrPrPg2PBL B+WEEwTwKyAVOSsPRVpt86OVD0dKxmBDLSlOHBgo0KM/O4qYxYKOCaxYtjSHbDwVQv uxRxAzQ3eAFYq1S+1Hb2g8vRRDjMXh7sd+OO/xn1wEeGhe95PhjS+Sixi5+vcaSk3E P3Fi4whcEoR0g==
To: uta@ietf.org
References: <CAOEezJSQ=ddW4vs+K0Dj7DmG3Pz1K2sHLSmHSFJJNf1xk868iA@mail.gmail.com>
From: Alice Wonder <alice@domblogger.net>
Message-ID: <c6bc621a-11f2-00b6-35d4-dd0620ff3a6a@domblogger.net>
Date: Sat, 05 Jan 2019 16:55:59 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <CAOEezJSQ=ddW4vs+K0Dj7DmG3Pz1K2sHLSmHSFJJNf1xk868iA@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/uta/ImXMULecFTzBTr9uM_FHGutQjRo>
Subject: Re: [Uta] SMTP Over TLS on Port 26 - Implicit TLS Proposal
X-BeenThere: uta@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: UTA working group mailing list <uta.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/uta>, <mailto:uta-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/uta/>
List-Post: <mailto:uta@ietf.org>
List-Help: <mailto:uta-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/uta>, <mailto:uta-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 06 Jan 2019 00:56:05 -0000

On 1/5/19 7:50 AM, Viruthagiri Thirumavalavan wrote:
> Hello UTA WG,
> 
> I have a proposal for SMTPS (Implicit TLS), port 25 secure alternative 
> on a new dedicated port 26.
> 
> Both MTA-STS and MTA-DANE tries to fix the STARTTLS downgrade issue. 
> However the implementation is not simple. The former requires a HTTPS 
> server and the latter requires DNSSEC

Hi,

While it is true MTA-STS requires a web server, it can be a static host 
and does not need to be run on same IP / host as the SMTP server.

There are plenty of lightweight free daemons out there that can securely 
serve static content over TLS.

For those who do not yet implement DNSSEC it is a very easy solution and 
is not a barrier to advertising that MTA clients should use TLS when 
connecting and require they use a validating certificate.

v2.46.0 | Report a Bug | By Email | System Status