Solved

Encryption for e-mail local delivery

Posted on 2016-10-09
1
52 Views
Last Modified: 2016-10-10
Hello!

I understand well what happens when SMTP server, say Postfix contacts remote SMTP server to send or receive mail. The connection could (and should) be encrypted, certain ports must be used and the certificate must be valid and accepted by all parties.
But when it comes to the local e-mail delivery for me it's a grey area. Ok, let's say if we're talking about receiving mail and Postfix already got it from the remote server. Then we have MDA (like Courier) that takes the mail from Postfix and gives it to a MUA (like Thunderbird Mail, for example). I'm talking about one physical machine and one user session. What the purpose of the encryption if it all happens inside and no third party could be present? And if it's the case of the same computer and the same user, then does the validity of the cert play any role for e-mail delivery process from Postfix via Courier to Thunderbird Mail?
0
Comment
Question by:papa kota
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 37

Accepted Solution

by:
ArneLovius earned 500 total points
ID: 41836763
The delivery of mail over the internet can happen within STARTTLS

the MTA (Postfix/Sendmail/QMAIL) does not encrypt mail in this scenario, the mail is sent in plain text, but the communication between the mail servers that carries the email is encrypted.

After delivery from the remote MTA, the email exists on the server in a plain text form. The email is not "sent" to Courier-IMAP, or the MUA such as Thunderbird, but rather Thunderbird connects to courier (hopefully over IMAPS) which then opens the "mailbox" effectively "proxying" access to the mailbox, again the connection is in plaintext, with the communication encrypted with IMAPS.

IMAP/IMAPS and SMTP/SMTP STARTTLS have a similar relationship to HTTP/HTTPS

If Postfix, Courier-IMAP and Thunderbird are all of the same single user machine connecting over localhost, then the IMAPS certificate is less of an issue as sniffing the traffic across a network is no longer possible, but it still should be used in case somebody is able to run a a packet sniffer on the computer.

If you have a public certificate for SMTP STARTTLS, then I would usually use the same certificate for IMAPS
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Phishing attempts can come in all forms, shapes and sizes. No matter how familiar you think you are with them, always remember to take extra precaution when opening an email with attachments or links.
Familiarize people with the process of utilizing SQL Server functions from within Microsoft Access. Microsoft Access is a very powerful client/server development tool. One of the SQL Server objects that you can interact with from within Microsoft Ac…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question