Tests to perform:

[LecrisUT]

• TLS connection on port 465.
• What order does/should mailout try to send mails (e.g. IPv6 port 25 -> IPv6 port 587 ... or IPv6 port 25 -> IPv4 port 25 ...)
• How does mailout react to self-signed certificates on ports 587 and port 465.
• Does mailout reject unsecured connection on port 465
• Can mailout detect MIM attacks when using STARTTLS and/or regular TLS?

[xtuc]

What order does/should mailout try to send mails (e.g. IPv6 port 25 -> IPv6 port 587 ... or IPv6 port 25 -> IPv4 port 25 ...)

It's hard to know what would be best, currently we rely on the default Golang implementation for the DNS lookup which seems to prefer IPv6.

Self-signed certificates

Currently they will fail. It will also help block MIM attacks and TLS certs are easy enough to generate so I think it's good.
Do you think we should accept them?

unsecured connection on port 465

If initiating with TLS fails, it will fallback to clear with STARTTLS. If STARTTLS isn't available it will eventually fallback to unsecure.
I would say that's pretty standard.

[LecrisUT]

What order does/should mailout try to send mails (e.g. IPv6 port 25 -> IPv6 port 587 ... or IPv6 port 25 -> IPv4 port 25 ...)

It's hard to know what would be best, currently we rely on the default Golang implementation for the DNS lookup which seems to prefer IPv6.

So the priority is on port then? I think that's best to make sure we go through secure connection.

Self-signed certificates

Currently they will fail. It will also help block MIM attacks and TLS certs are easy enough to generate so I think it's good.
Do you think we should accept them?

I need to double check this when I reimplement certificate authentication, because I had to add the self-signed CA when I tested it. Hopefully this is circumvented in SMTP until the auth step.

I don't think there are other situations where you would have self-signed certificates. If it's on a private network, you would also self-host mailout and have control of the system's trust authority.

unsecured connection on port 465

If initiating with TLS fails, it will fallback to clear with STARTTLS. If STARTTLS isn't available it will eventually fallback to unsecure.
I would say that's pretty standard.

I think that port 465 should be handled differently and only allow if initial TLS passes. Mostly because if it fails, it means there is a missconfiguration and the user relyes on port 465 to be TLS by design, otherwise they'd be using 587.