How Does MTA-STS Improve Your Email Security?

Simple Mail Transfer Protocol or SMTP has easily exploitable
security loopholes. Email routing protocols were designed in a time
when cryptographic technology was at a nascent stage (e.g., the
de-facto protocol for email transfer, SMTP, is nearly 40 years old
now), and therefore security was not an important
consideration.

As a result, in most email systems encryption is still
opportunistic, which implies that if the opposite connection does
not support TLS, it gets rolled back to an unencrypted one
delivering messages in plaintext.

To mitigate SMTP security problems, MTA-STS^[1] (Mail Transfer Agent
Strict Transport Security) is the recommended email authentication
standard. It enforces TLS in order to allow MTAs to send emails
securely. This means that it will only allow mail from MTAs that
support TLS encryption, and it will only allow mail to go to MX
hosts that support TLS encryption.

In case an encrypted connection cannot be negotiated between
communicating SMTP servers, the email is not sent, instead of being
sent over an unencrypted connection.

Analyzing the risks involved in transferring emails over an
unencrypted SMTP connection

STARTTLS is a communication protocol extension to the SMTP email
transfer protocol that allows both the communication partners to
upgrade an unencrypted communication to encrypted communication.
This backward-compatible security implementation was retrofitted
into SMTP to ensure that all clients can connect with some level of
encryption. When SMTP was first created in the 1980s, it didn’t
have any security measures to ensure the communication between mail
servers was sent in an encrypted form—it just sent mail as plain
text.

A known vulnerability in the protocol design of the SMTP can be
exploited to downgrade a connection easily. Since SMTP was not
designed to be encrypted, the upgrade for encrypted delivery is
performed by sending an unencrypted STARTTLS command. This enables
a Man-in-the-middle attacker to tamper with the STARTTLS command,
thereby downgrading the TLS-encrypted connection to an unencrypted
one. This forces the email client to fall back to sending
information in plaintext. The attacker can then easily access and
eavesdrop on the decrypted information.

Cyber Eavesdropping attacks like MITM can jeopardize sensitive
information exchanged between officials of an organization, leading
to the leakage of company databases and login credentials.

How to Ensure TLS Encryption with MTA-STS?

MTA-STS makes TLS encryption mandatory in SMTP, which ensures
that messages are not sent over an unsecured connection, or
delivered in plaintext. This in turn keeps Man-in-the-middle and
DNS spoofing attacks at bay by stopping attackers from intercepting
email communications.

PowerDMARC’s hosted MTA-STS services help eliminate the
complications that come with adopting the protocol, by making the
overall process easy for domain owners.

Our hosted MTA-STS provides domain owners with the following
benefits:

• We host and manage the policy files and certificates on your
  behalf
• Adopting the protocol is as easy as publishing a few DNS CNAME
  records, making it effortless and speedy
• A dedicated dashboard to manage and modify the protocol
  configurations that enable you to make changes to your MTA-STS
  record without having to access your DNS
• PowerDMARC’s hosted MTA-STS services meet the RFC compliance
  requirements as well as the current TLS standards

What concerns domain owners after implementing MTA-STS is how to
get alerted during situations where an encrypted connection cannot
be negotiated and messages fail to get delivered. However, keeping
this issue in mind experts curated SMTP TLS
reporting^[2], a mechanism that
notifies you of delivery issues.

How to View and Manage Your TLS Reports?

TLS-RPT allows you to get notified of email delivery failure on
TLS encrypted channels; it analyzes and reports all possible issues
within those channels, allowing you to react to a TLS issue and
deliver a message back without any delay. It is an excellent
addition to MTA-STS as it addresses the concern pertaining to
emails getting lost during transfer.

PowerDMARC’s hosted TLS-RPT services:

• Gives you access to a dedicated dashboard that automatically
  parses your TLS reports (originally sent in JSON format), to make
  them simple and human-readable
• TLS-RPT data is organized into tables, with actionable buttons
  and icons for ease of use and navigation
• Furthermore, your reports are assorted into two separate
  viewing formats: per sending source and per result, for better
  visibility and clarity, and an enhanced user experience.

PowerDMARC helps you deploy and manage email authentication
solutions like DMARC^[3], SPF, DKIM, BIMI^[4], MTA-STS, and TLS-RPT,
under a single roof without having to deploy them separately for
your domain!

To avail the benefits of email authentication at your
organization, and combat the risk of phishing, spoofing,
ransomware, and MITM attacks, sign up for a free DMARC
Analyzer^[5]
today!