TLS Cipher Suites for MTA

When configuring a mailgateways TLS Settings, should one stick to the same rules for Cipher Suites as in running a HTTPS Service (prefer EDCHE/DHE,disable SSLv3, not using stuff like RC4, etc.) or should one focus more on compatibility with other MTAs to prevent email getting sent unencrypted.

It seems to me it´s a tradeoff, with using only strong Cipher Suites on the one hand I´m improving the security of a majority of mails transfered because you can´t downgrade on weak Cipher Suites or SSLv3. But on the other hand I give up encryption for some mails because they get sent unencrypted (if the other MTA is extremly old and just supports RC4 for example).

Continue reading TLS Cipher Suites for MTA

TLS Cipher Suites for MTA

When configuring a mailgateways TLS Settings, should one stick to the same rules for Cipher Suites as in running a HTTPS Service (prefer EDCHE/DHE,disable SSLv3, not using stuff like RC4, etc.) or should one focus more on compatibility with other MTAs to prevent email getting sent unencrypted.

It seems to me it´s a tradeoff, with using only strong Cipher Suites on the one hand I´m improving the security of a majority of mails transfered because you can´t downgrade on weak Cipher Suites or SSLv3. But on the other hand I give up encryption for some mails because they get sent unencrypted (if the other MTA is extremly old and just supports RC4 for example).

Continue reading TLS Cipher Suites for MTA