9

First things first: I know about the difference between end-to-end-encryption and transport encryption.

Back to topic: I already read some things about how mail server handle transport encryption, e.g. How Can You Tell if an Email Was Transmitted Using TLS Encryption?.

Here are two examples for incoming mail to my provider's mail server (I edited the second one):

Received: from mout.gmx.net (mout.gmx.net [212.227.15.19])
    by mx02.posteo.de (Postfix) with ESMTPS;
Received: from XXX (YYY [1.2.3.4])
    by mx02.posteo.de (Postfix) with ESMTP

Does the occurrence of ESMTPS in the first example mean that TLS was used for transport encryption?

Does the occurrence of ESMTP in the second example mean that the mail was transferred unencrypted between the two servers?

sebix
  • 298
  • 3
  • 15
HorstKevin
  • 1,418
  • 4
  • 15
  • 29

1 Answers1

8

Does the occurrence of ESMTPS in the first example mean that TLS was used for transport encryption?

Yes, but only if you believe the MTA that inserted that header and every MTA that touched the message subsequently. Any of those MTAs could write that information into the header even if it isn't true.

Does the occurrence of ESMTP in the second example mean that the mail was transferred unencrypted between the two servers?

No, here's a counterexample:

Received: from XXX (XXXX [IPv6:XXX])
    by XXX (XXversionXX) with ESMTP id XXXX
    (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NOT)
    for <XXXmy-addressXXX>; Tue, 23 Jun 2015 10:24:53 +0900

That mailer appears to have chosen to include information about the connection crypto in parentheses and did not write ESMTPS. So it appears there are definitely multiple ways of indicating this information in the header and you'd have to recognize them all. But once again, you cannot trust any of it anyway.

Celada
  • 666
  • 5
  • 10