Does Exchange 2010 encrypt inbound and outbound email traffic by default

exchange-2010starttlstls

The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to encrypt all outbound emails and falls back to unencrypted transport.

Is this the case with newer versions of Exchange? How reliable is this and how often is StartTLS employed by other mail servers?

If this method for encrypting mail traffic cannot be used reliably what are some other alternatives on the server side of things?

Best Answer

Assuming you already have a cert installed,

Create an additional Send Connector
specify the domains that require TLS in the Address Space section of the send connector
check the "Enable Domain Security (Mutual Auth TLS)" checkbox in the Network section of the new Send Connector

That checkbox ensures that TLS must be supported on the remote end, or sending will fail.

Related Solutions

Security – How to inspect remote SMTP server’s TLS certificate

You can use OpenSSL. If you have to check the certificate with STARTTLS, then just do

openssl s_client -connect mail.example.com:25 -starttls smtp

or for a standard secure smtp port:

openssl s_client -connect mail.example.com:465

Centos – How to change sendmail fallback behavior if TLS handshake fails

According to this thread, the fallback feature tls_failures was implemented in this patch. Apparently this will use plain text automatically after a certain number of TLS handshake failures.

Note: this patch is integrated in 8.16 (at least available as snapshot)

As of this post, 8.16 is not yet released, so for now you will have to use /etc/mail/access or /etc/mail/access_db as Seth suggested, and be sure to rebuild the .db using makemap hash /etc/mail/access < /etc/mail/access

As for security risks of using tls_failures globally; considering that this is opportunistic TLS to begin with, I think that refraining from using this new option would only help in some really fringe cases where the recipient mailserver is temporarily reconfigured and later corrected.

Best Answer

Related Solutions

Security – How to inspect remote SMTP server’s TLS certificate

Centos – How to change sendmail fallback behavior if TLS handshake fails

Related Topic