Subject: [ietf-smtp] starttls-everywhere

From: Jeremy Harris <[email-masked]>
Date: Sun, 31 Mar 2019 11:53:14 +0100

Of the several hundred records in the policy file, not
a single one is for enforcing mode.  All are "testing".

Has the project stalled?
-- 
Cheers,
  Jeremy

---

From: [email-masked]
Date: Sun, 31 Mar 2019 13:33:21 +0200

is it no the best way to do itnow

something like 95 % of my connections nowadays are tls, but most of
the connections are with certificates that do no validate.
temporary and the like.

would going to enforcing not invalidate all these connections?
and the fallback to non-encrypted smtp? shooting yourself in the foot...

keld 

On Sun, Mar 31, 2019 at 11:53:14AM +0100, Jeremy Harris wrote:
> _______________________________________________
> ietf-smtp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-smtp

---

From: Phil Pennock <[email-masked]>
Date: Sun, 31 Mar 2019 15:16:53 -0400

> and the fallback to non-encrypted smtp? shooting yourself in the foot...

No: the point of the STARTTLS-Everywhere system is that, like both DANE
and MTA-STS, the sender does _not_ fall back to unencrypted SMTP.

Except in Testing mode.  Which is what Jeremy is explicitly asking
about: moving from "hint, but can still fall back" to "enforce, with no
fall back".

-Phil

---

From: [email-masked]
Date: Sun, 31 Mar 2019 22:14:59 +0200

in my mind that is not a good way forward,
I thnk it will break up email as an internet service.
I would much rather go the upwards compatible path,
like we did for smtp/esmtp which I think has been very succcsful. 

The esmtp transition has been so successful because we designed 
it to be so, and nobody was hurt. Transition to starttls has been very successful
also because it was designed to be smooth. Please don't break email!

keld