Enforce TLS incoming/outgoing

amnesia

I am probably overlooking it, but I cannot find any detailed information about this feature in the documentation. Would someone be willing to explain in greater detail what this means and what the recommended settings are?

My understanding is that it enforces TLS for all server-to-server inbound or outbound communication. If that’s the case I don’t understand why this is a user-configurable option. How would that work on a per-mailbox basis?

This seems like something that should be enabled by default, but I don’t want to disrupt any mail delivery. Does anyone have a feel for how many other servers do or do not use TLS these days? In other words, if I enable this, would I only be blocking traffic from a small percentage of poorly configured servers, or is this not yet widely adopted?

What I would really prefer is a way to enforce that all users connect to the mailcow server via TLS for both incoming and outgoing. Server-to-server is less of a concern. Is this possible?

esackbauer

https://docs.mailcow.email/client/client-manual/
“Contrary to what the name implies, the password will not be transferred to the server in plain text as no authentication is allowed to take place without TLS”
So for the clients TLS is already enforced.

Server to Server communication is never enforced, to not miss anything. I have actually no idea how high the percentage is of unencrypted mails, but I guess if you look at the SMTP headers of your mails received you should get an idea.
However you can enforce TLS for certain sender domains, I have it in place for the well known mailing services gmail.com, outlook.com etcetc.

amnesia

esackbauer

I see, thank you.

So if a remote sender is already using TLS, say gmail for example, then what is the reason to enforce it for that sender? Does it prevent some sort of attack vector?

esackbauer

amnesia Does it prevent some sort of attack vector?

Yes, a rogue MTA or router in between your server and the destination server could force a downgrade to unencrypted SMTP traffic, and could read the mail in clear text.

amnesia

Got it. Thanks again!