In and of itself, SMTP is an insecure protocol. It\nessentially lacks any real security features, which is why other methods of\nauthentication and secure transmissions are required. <\/p>\n\n\n\n
Around 2004, researchers were trying to solve the problem of how to trust where the message was originating because SMTP was designed in a way that the displayed sender \u201cFrom” field need not match the envelope sender \u201cMail From\u201d field. So then how would you verify if your friend Jerry was sending you the email or whether someone was impersonating him?\u00a0 <\/p>\n\n\n\n
This is why authentication methods<\/a> like Sender Policy Framework (SPF)<\/a>, DomainKeys Identified Mail <\/a>(DKIM<\/a>), etc. came into the picture in an attempt to prevent the sharing of fraudulent emails<\/a> via phishing attacks or spoofed addresses. <\/p>\n\n\n\n Email signing certificates<\/a>, which not only can utilize end-to-end email encryption but also help to verify the identity of the sender, is another method of increasing email security. SSL\/TLS certificates<\/a> also add additional layers of security by encrypting the email servers themselves<\/a>.<\/p>\n\n\n\n SPF records map IP addresses to specific domains\nindicating to the receiving client which addresses can send emails on behalf of\na domain.<\/strong> Irregular SPF records (with permerror, fail, etc.) could be an\nindication of spoofed email addresses. The DNS records (the system that\ntranslates domain names to IPs) linked to a domain lets the client know which\nserver wants to communicate with them, or if a client is sending a message, which\nserver it\u2019s talking to. <\/p>\n\n\n\n A TXT record, a type of DNS record, can hold SPF data and is used to indicate to a mail exchange server which hosts from a domain are authorized to send emails. However, this isn’t a foolproof method, and it also requires administrative efforts to maintain the records and time for any changes to propagate across the internet every time the fields update. <\/p>\n\n\n\n Most of the time, instead of implementing a hard fail that\nmay block vital emails, organizations employ a soft fail mechanism that displays\na warning message whenever an email with unverified values gets delivered. <\/p>\n\n\n\n DKIM, on the other hand, is a digital signature that\u2019s used to assert authenticity and verify if the content of an email message was modified. <\/strong><\/p>\n\n\n\n DMARC<\/strong> was defined in RFC 7489 in the year 2015 and is\nmeant to work alongside SPF and DKIM as a mechanism that describes how to\nrespond to potentially spoofed emails.<\/strong> It essentially relies on one method\nor the other to authenticate an email. Depending on the value of the \u201cp\u201d flag\nin DMARC, the receiving server can either reject or quarantine the email. They\ncan also opt to do nothing by setting the value as none and merely gain\nvisibility without impacting the flow. <\/p>\n\n\n\n The \u201crua\u201d is another prominent flag that can be used to specify\nthe list URIs where feedback can be sent (like the email address of a security\ngroup in the form \u201cmailto:dummyaddress@example.com\u201d). Another flag worth\nmentioning is the \u201cpct\u201d tag that describes the percentage of your email to which\nan action will be applied. For instance, if your DMARC record is set as \u201cp=reject,\npct=0\u201d it translates to the reject policy will be applied to zero percent of\nthe domain\u2019s messages. <\/p>\n\n\n\n A word of caution: Be wary when you see this flag, or about\nusing it if you\u2019re a domain owner. It can completely undermine the value that\nDMARC provides for email security.<\/p>\n\n\n\n Simple mail transfer protocol secure (SMTPS), in the days\nlong gone, used port 465 to secure SMTP at the transport layer by wrapping it\ninside a TLS (transport layer security) connection. The confusion around secure\nSMTP ports is understandable since the Internet Assigned Numbers Authority\n(IANA) at one point had taken the liberty to register port 465 to be used for\nSMTPS. <\/p>\n\n\n\n Let\u2019s take a look at each of these ports individually to\ngain a better understanding of secure SMTP ports:<\/p>\n\n\n\n Port 465 was never officially recognized by the IETF as an\nSMTP port, but since IANA had registered it to be used for SMTPS, it may still\nbe used as an SMTP SSL port in some legacy systems. However, by the end of 1998,\nIANA had assigned a new service to this port. As such, it\u2019s better to not use\nit as a secure SMTP communication even if your service provider extends support\nfor it.<\/p>\n\n\n\n In a nutshell, port 25 is still used for SMTP relaying. In\nfact, with SMTP STS, which segregates message submission and message relaying,\nport 25 continues to be used for relaying a message from one mail server to\nanother. However, unless you\u2019re in charge of managing a message transfer agent\n(MTA) or a mail server, this port may be blocked for you, and normally you\nshould see no traffic on this port. <\/p>\n\n\n\n Port 587 should be used as the default port for submitting\nemail messages to a mail server along with TLS encryption as per the guidelines\nlaid out by the Internet Engineering Task Force (IETF). Transport layer\nsecurity can be implemented in two ways \u2014 opportunistic (explicit) TLS or\nthrough forced (implicit) TLS.<\/p>\n\n\n\n With opportunistic TLS, first, an attempt is made to\ntransfer the message in an encrypted form by switching from a non-encrypted\nchannel to a secure one using the STARTTLS command. However, if both client and\nemail servers can\u2019t agree upon an encryption standard, the message is\ntransmitted in plaintext.<\/p>\n\n\n\n In the case of forced TLS, on the other hand, if the\nnegotiation fails, and the email client and server can\u2019t support the same\nencryption standards, the message delivery then fails as well. <\/p>\n\n\n\n Port 2525 is not recognized officially by either IETF or\nIANA, but it is commonly supported by most email service providers in case port\n587 has been blocked for some reason. <\/p>\n\n\n\n Hopefully, your questions around SMTP security and secure SMTP\nports that enable encrypted email communications have been answered. Though\nemail security is still a work in progress, we\u2019ve come a long way from the days\nof open relay. As you\u2019ve discovered, we can now sign our emails, block IPs,\nhave the server perform a consistent action if verification fails and share\nfeedback to gain visibility into where we might be going wrong. <\/p>\n\n\n\n New email security standards are continually being developed, the latest being SMTP STS, defined by RFC 8461<\/a>. It works alongside STARTTLS and is a mechanism that tries to avoid encryption downgrades. Gmail<\/a> was the first email provider to adopt SMTP MTA STS and SMTP TLS reporting. <\/p>\n","protected":false},"excerpt":{"rendered":" All you need to know about secure SMTP SSL ports 587, 25, 465 and 2525, and the roles they play in email security Simple mail transfer protocol (SMTP), which many…<\/p>\n","protected":false},"author":9,"featured_media":752,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[47],"tags":[46],"class_list":["post-751","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-email-security","tag-smtp","post-with-tags"],"yoast_head":"\nSPF, DKIM, and DMARC: The Three DNS Records That Are Your Key to Email\nSecurity<\/h2>\n\n\n\n
Sender Policy Framework<\/h3>\n\n\n\n
DomainKeys Identified Mail<\/h3>\n\n\n\n
Domain-based Message Authentication, Reporting, and Conformance<\/h3>\n\n\n\n
![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/03\/secure-smtp-email-header-example-1024x294.png\")
<\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/03\/secure-smtp-security-example.png\")
<\/figure><\/div>\n\n\n\nSecure SMTP SSL Ports <\/h2>\n\n\n\n
Port 465<\/h3>\n\n\n\n
Port 25<\/h3>\n\n\n\n
Port 587<\/h3>\n\n\n\n
Port 2525<\/h3>\n\n\n\n
In Summary<\/strong><\/h2>\n\n\n\n