What’s StartTLS? – SendGrid

Ever marvel how e mail is securely despatched from one server to a different? When utilizing Easy Mail Switch Protocol (SMTP) to ship mail, we depend on a mixture of StartTLS and Transport Layer Safety (TLS) or Safe Sockets Layer (SSL) to encrypt our mail and assist it safely land within the inbox. 

However what’s StartTLS?

StartTLS is a protocol command used to tell the e-mail server that the e-mail consumer needs to improve from an insecure connection to a safe one utilizing TLS or SSL. StartTLS is used with SMTP and IMAP, whereas POP3 makes use of the marginally completely different command for encryption, STLS. 

We’ll dig into the variations between TLS and SSL, the StartTLS course of, and find out how to take a look at StartTLS on your program. 

How does StartTLS work?

TLS vs. SSL

Though “TLS” is in its identify, StartTLS works with each encryption protocols, TLS and SSL. 

Whereas StartTLS works with each protocols, we advocate utilizing TLS over SSL. SSL is an older protocol and isn’t as safe as its successor, TLS. SSLv2 and SSLv3 have each been deprecated.

For reference, right here’s an inventory of SSL and TLS protocols from oldest to latest: 

SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 

Each the e-mail consumer and e mail server must agree on what connection to make use of. The e-mail consumer might help TLSv1.3, however the e mail server might solely help as much as TLSv1.2. Because of this each events might want to use TLSv1.2 to proceed with the encryption.

For much more data on TLS vs. SSL, take a look at our docs web page.

The StartTLS course of

SMTP at all times begins unencrypted. The StartTLS command begins the negotiation between server and consumer. Right here’s an overview of the communication that occurs between the e-mail consumer and e mail server.

1. The method begins with the Transmission Management Protocol (TCP) handshake to assist each the e-mail consumer and server determine one another.
2. The server identifies with 220 Prepared that the e-mail consumer can proceed with the communication.
3. The consumer sends the server “EHLO” to tell the server that the consumer want to use Prolonged SMTP (the extra superior model of SMTP that permits you to embrace photographs, attachments, and so on.).
4. The consumer sends “250-STARTTLS” to the mail server to ask whether or not or not StartTLS is accepted.
5. If the server sends again “go head,” the StartTLS connection will be created. 
6. The consumer restarts the connection and the e-mail message has been encrypted.

Right here’s a visible illustration of the StartTLS course of.

Which port must you use?

The port that makes use of StartTLS most frequently is port 587. It usually requires e mail shoppers to make use of StartTLS to ship mail. Different ports used to ship encrypted mail are 25, 465, and 2525. Since port 25 was designed for mail switch, not submission, your ISP might block e mail despatched by means of this port. Port 465 is the second mostly used port for StartTLS.

Opportunistic vs. Enforced TLS

There are a few alternative ways to arrange your e mail encryption program by utilizing both Opportunistic TLS or Enforced TLS:

Opportunistic TLS (or Specific TLS) permits the e-mail consumer to ship on the very best encryption stage the recipient server accepts. If the recipient server doesn’t settle for TLS, the e-mail consumer will negotiate with the server and comply with downgrade to an unencrypted connection. The message will then be despatched in an unencrypted, plain textual content kind. This technique is helpful as a result of you need to use the identical port for each encrypted and plain textual content mail.

Enforced TLS (or Implicit TLS) requires the mail to be despatched over a safe connection. If the connection will not be encrypted, the mail might be blocked from sending. This technique is rather more safe than Opportunistic TLS, however does result in extra mail being dropped. 

Each approaches are extensively used within the e mail world, so take into account what makes probably the most sense on your program. In case you are sending e mail that comprises delicate, private data, it could be greatest to make use of Enforced TLS. However, for those who’re sending non-sensitive materials, like advertising or promotions, you might be extra inclined to make use of Opportunistic TLS. 

Different TLS use circumstances

TLS is continuously used for encrypting a wide range of communication strategies exterior of e mail. Since TLS is a comparatively easy, multi-step protocol, it makes it simple to regulate for a wide range of communication sorts. This contains net browsers, SMS, and Voice over IP. The truth is, a number of corporations use TLS to encrypt all communication between their net servers and browsers, even when nearly all of the communication isn’t delicate materials.

For extra data on how Twilio makes use of TLS, take a look at Twilio’s Safety web page.

Why is StartTLS essential?

SMTP will not be secured by default, which implies that for those who had been to ship e mail over SMTP with out StartTLS the e-mail may very well be intercepted and simply interpreted. That is particularly worrisome when sending delicate, private data like usernames, passwords, or financial institution data. 

With out StartTLS, your private data is vulnerable to being stolen. 

When an e mail consumer makes use of StartTLS, it informs the server that the content material have to be encrypted. This manner, if the mail is intercepted, the content material has been scrambled and may be very difficult to decipher. The e-mail server and e mail consumer are the one ones that maintain the important thing to decode the message. 

Drawbacks

There are particular drawbacks to utilizing StartTLS. E mail shoppers are inclined to man-in-the-middle assaults as a result of, within the preliminary connection between e mail consumer and server, the IP addresses should not encrypted. 

Utilizing StartTLS might additionally add some latency to the SMTP connection. This could not be sufficient of a delay to make it essential to ship unencrypted e mail, however it’s good to bear in mind.

How do I take a look at StartTLS?

It’s essential to check prematurely to verify the server is able to processing StartTLS. If it isn’t able to processing StartTLS you possibly can by chance ship a good quantity of e mail that isn’t encrypted and is, due to this fact, inclined to assault vectors.

Right here is an instance of how you’d take a look at StartTLS from SendGrid’s SMTP server.

How does Twilio SendGrid use StartTLS?

Twilio SendGrid helps TLS v1.1 and better. Unencrypted and TLS connections are accepted on ports 25, 587, and 2525. Or, you’ll be able to join by means of SSL on port 465. 

We observe Opportunistic TLS and ship on the very best encryption stage the recipient server accepts. We additionally supply Enforced TLS. It’s your alternative whether or not or not you require your e mail to be despatched over an encrypted connection. If the recipient server doesn’t settle for encrypted messages, the message is dropped and we ship a block occasion.

You’d primarily work together with StartTLS when initiating the SMTP request to Twilio SendGrid, asking to ship mail. In any other case, Twilio SendGrid handles the matching of the TLS certificates, the remainder of the encryption course of, and any points which will come up alongside the best way.

For extra data on Twilio SendGrid and SMTP, head over to our docs article, Find out how to Ship an SMTP E mail. And once you’re prepared to begin sending emails, join a free Twilio SendGrid account and get began.