As a result, we have decided to build and add support for DNSSEC and DANE for SMTP to Exchange Online. Microsoft has been working closely with partners through the industry association M 3AAWG to solve such limitations throughout the email ecosystem. Even if the connection is encrypted, the sending server will never know that email was diverted to the malicious server.
An attacker can spoof the receiving SMTP gateway’s DNS record and present an alternate MX record for a server that they own. This happens when an attacker is able to strip the STARTTLS verb from the target SMTP gateway during the initial in-the-clear communication, often resulting in the sending SMTP server simply deciding to continue sending the message in clear text rather than stopping transmission.Īnother limitation that exists with Opportunistic TLS is the inability for the sending server to authenticate the identity of the receiving SMTP gateway. One such vulnerability is the downgrade attack, which is a form of man-in-the-middle-attack (MITM). Opportunistic TLS provides encryption for SMTP connections and even though it’s a great improvement over plain SMTP, it still has a significant number of vulnerabilities. This is often referred to as Opportunistic TLS, or STARTTLS. Over time, as security and privacy became increasingly more important, several new standards emerged and one of those is RFC 3207 : “SMTP Service Extension for Secure SMTP over Transport Layer Security (TLS)”. The SMTP protocol was designed a long time ago, when message delivery was considered more important than security. These standards are DNSSEC (Domain Name System Security Extensions) and DANE for SMTP (DNS-based Authentication of Named Entities). Today we are announcing that Exchange Online will be adding support for two new Internet standards specific to SMTP traffic. Microsoft is committed to providing world-class email security solutions and the support for the latest Internet standards in order to provide advanced email protection for our customers.
0 kommentar(er)
