STARTTLS

SMTP started cleartext. Modern email needs TLS.

Two approaches:

1. Implicit TLS: connect on port 465 (SMTPS). TLS from byte 1.
2. STARTTLS: connect on port 25 or 587, upgrade mid-session.

STARTTLS flow:

S: 220 mail.example.com ESMTP
C: EHLO client.example.com
S: 250-mail.example.com Hello
S: 250-STARTTLS
...
C: STARTTLS
S: 220 Ready to start TLS
[TLS handshake here]
C: EHLO client.example.com    (re-greet over TLS)
S: 250-mail.example.com Hello
...

After STARTTLS, conversation is TLS-encrypted. Client must re-issue EHLO; server may advertise different capabilities (e.g., AUTH only available after TLS).

STRIPTLS attack: passive attacker strips the STARTTLS line from server's EHLO response. Client thinks server doesn't support TLS, falls back to cleartext.

Defenses:

• MTA-STS (RFC 8461): policy declared in DNS+HTTPS that says "this domain requires TLS". Clients honor it; reject cleartext.
• DANE (RFC 6698): TLSA records in DNS pin certificate fingerprints.
• Opportunistic vs strict TLS: opportunistic (try TLS, fall back to cleartext) was norm but strip attack defeats; strict (require TLS or fail) is increasingly default.

Cipher suites:

• TLS 1.2 + AES-GCM minimum.
• TLS 1.3 preferred.
• No SSL 2/3, no RC4, no MD5.

Certificates:

• Server cert covers the MX hostname (or domain).
• Client typically doesn't authenticate (anonymous TLS for inbound). Outbound MTAs may pin certs (DANE).

Modern Gmail/Outlook: ~95% of email traffic now travels TLS-encrypted between major providers. Self-hosted is more variable.