📨

SMTP Security: STARTTLS, MTA-STS & DANE

Medium

Free preview · 2 of 5 steps

SMTP security: opportunistic vs enforced TLS

Email between mail servers (SMTP MTA-to-MTA) uses STARTTLS for encryption. But STARTTLS is opportunistic — if the receiver doesn't advertise it, the sender falls back to plain text. An attacker on the path can simply strip the STARTTLS advertisement, forcing plaintext delivery.

MTA-STS and DANE solve this by establishing a policy: 'always use TLS when delivering to this domain.' Breaking TLS causes delivery failure — not silent downgrade to plaintext.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step