{"id":11358,"date":"2019-08-06T16:14:01","date_gmt":"2019-08-06T20:14:01","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11358"},"modified":"2020-08-26T13:59:25","modified_gmt":"2020-08-26T17:59:25","slug":"encryption-and-email-servers","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/encryption-and-email-servers\/","title":{"rendered":"SSL\/TLS Encryption and Email Servers"},"content":{"rendered":"\n

What you need to know about using SSL\/TLS to encrypt connections made by\nyour email servers<\/h2>\n\n\n\n

When I was approached\nwith the topic for this blog post, I happily agreed. Here\u2019s some paraphrasing\nof how it went down:<\/p>\n\n\n\n

\u201cWould you be able to\nwrite a post about the importance of TLS in email servers?\u201d asked Patrick.<\/p>\n\n\n\n

\u201cSure,\u201d I said. <\/p>\n\n\n\n

Whew, that was a crazy\nconversation to relive! Like a whirlwind!<\/p>\n\n\n\n

Then I started thinking about it for a bit. Are there really email servers out there that are not using encryption for transit? I\u2019m not talking about end-to-end encryption like we have covered in the past (S\/MIME<\/a>, PGP<\/a>, etc). I am referring to server to server or everything in between encryption to protect the data along the traversing route. <\/p>\n\n\n\n<\/span><\/span>\n\n\n\n

Surely, in this day and age, no one would leave their incoming\/outgoing mail in plaintext traversing God knows which route to be intercepted and taken advantage of. Many people are using email services and there\u2019s no way that they would be excluding transit encryption from their service. Data breaches cost them millions in\nlawsuits and loss of business and shame\u2026\u2026Hmmmm\u2026..<\/span><\/p>\n\n\n\n

I went back to Patrick\nwith a question.<\/p>\n\n\n\n

\u201cDo we have statistics\nor information about email servers not using encryption? My guess is it would\nbe low. In other words, what prompted you to ask me about this article?\u201d <\/p>\n\n\n\n

Patrick replied, \u201cI\nactually don\u2019t. I thought it would be a good topic considering the importance\nof email and all of the aspects needed for security.\u201d<\/p>\n\n\n\n

[Editor\u2019s Note: According to Google it\u2019s about 93%, though its methodology was opaque so we\u2019re not sure how accurate that is for the greater internet. Either way let\u2019s say about 90-95% which is good, email encryption is a requirement for pretty much every compliance framework including HIPAA, HITECH, PCI DSS, Sarbanes-Oxley, GLBA, SB1386, SEC 17a-4, NASD3010, FRCP, FINRA, etc.]<\/span><\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

OK. That makes sense. There probably are some email servers out there [about 7%, per Google] not using it at all, though undoubtedly a much larger percentage may be using out of date protocols<\/a> or expired certs<\/a> and may just need a refresh. <\/p>\n\n\n\n

This article will go\nover where we are at with the email and transit encryption to make sure you are\noperating at an optimal safety level that is available. <\/p>\n\n\n\n

Encryption in Email Servers<\/h2>\n\n\n\n

At this point, we probably have a general understanding of how TLS works<\/a> but let\u2019s summarize in case you are new to this. <\/p>\n\n\n\n

\"HIPAA<\/figure><\/div>\n\n\n\n

Person A wants to send\nsecure communication Human B. Person A and Human B have a pre-established\ncertificate. Person A uses the certificate to encrypt the information and sends\nthe encrypted information to Human B. The information is unreadable until Human\nB uses the certificate to decrypt the encrypted information. <\/p>\n\n\n\n

If Human B wants to\nrespond back to Person A with encrypted information, then Human B would use the\ncertificate to encrypt the data and Person A would use the certificate to\ndecrypt the message. <\/p>\n\n\n\n

This is generally how\nencrypting\/decrypting works. Now replace the people listed in this example with\nservers and other such connections. Same concept.<\/p>\n\n\n\n

Now if Human B wants to respond back to Person A with encrypted information, then Human B uses the symmetric key that was just generated and they can now both encrypt and send, and receive and decrypt data to one another. <\/p>\n\n\n\n

This is generally how encrypting\/decrypting with SSL\/TLS works. Now replace the people listed in this example with servers and other such connections. Same concept. This is how TLS works with email, which is a bit different than how it facilitates an HTTPS connection<\/a> owing to the fact that email uses different protocols. But, there are still some distinct similarities:<\/p>\n\n\n\n