What’s StartTLS? – SendGrid

Ever marvel how electronic mail is securely despatched from one server to a different? When utilizing Easy Mail Switch Protocol (SMTP) to ship mail, we depend on a mixture of StartTLS and Transport Layer Safety (TLS) or Safe Sockets Layer (SSL) to encrypt our mail and assist it safely land within the inbox. 

However what’s StartTLS?

StartTLS is a protocol command used to tell the e-mail server that the e-mail shopper desires to improve from an insecure connection to a safe one utilizing TLS or SSL. StartTLS is used with SMTP and IMAP, whereas POP3 makes use of the marginally totally different command for encryption, STLS. 

We’ll dig into the variations between TLS and SSL, the StartTLS course of, and learn how to take a look at StartTLS to your program. 

How does StartTLS work?

TLS vs. SSL

Regardless that “TLS” is in its title, StartTLS works with each encryption protocols, TLS and SSL. 

Whereas StartTLS works with each protocols, we suggest utilizing TLS over SSL. SSL is an older protocol and isn’t as safe as its successor, TLS. SSLv2 and SSLv3 have each been deprecated.

For reference, right here’s an inventory of SSL and TLS protocols from oldest to latest: 

SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 

Each the e-mail shopper and electronic mail server must agree on what connection to make use of. The e-mail shopper might help TLSv1.3, however the electronic mail server might solely help as much as TLSv1.2. Because of this each events might want to use TLSv1.2 to proceed with the encryption.

For much more data on TLS vs. SSL, try our docs web page.

The StartTLS course of

SMTP all the time begins unencrypted. The StartTLS command begins the negotiation between server and shopper. Right here’s an overview of the communication that occurs between the e-mail shopper and electronic mail server.

1. The method begins with the Transmission Management Protocol (TCP) handshake to assist each the e-mail shopper and server determine one another.
2. The server identifies with 220 Prepared that the e-mail shopper can proceed with the communication.
3. The shopper sends the server “EHLO” to tell the server that the shopper want to use Prolonged SMTP (the extra superior model of SMTP that allows you to embody photographs, attachments, and many others.).
4. The shopper sends “250-STARTTLS” to the mail server to ask whether or not or not StartTLS is accepted.
5. If the server sends again “go head,” the StartTLS connection might be created. 
6. The shopper restarts the connection and the e-mail message has been encrypted.

Right here’s a visible illustration of the StartTLS course of.

Which port must you use?

The port that makes use of StartTLS most frequently is port 587. It typically requires electronic mail shoppers to make use of StartTLS to ship mail. Different ports used to ship encrypted mail are 25, 465, and 2525. Since port 25 was designed for mail switch, not submission, your ISP might block electronic mail despatched by way of this port. Port 465 is the second mostly used port for StartTLS.

Opportunistic vs. Enforced TLS

There are a few alternative ways to arrange your electronic mail encryption program through the use of both Opportunistic TLS or Enforced TLS:

Opportunistic TLS (or Specific TLS) permits the e-mail shopper to ship on the best encryption stage the recipient server accepts. If the recipient server doesn’t settle for TLS, the e-mail shopper will negotiate with the server and comply with downgrade to an unencrypted connection. The message will then be despatched in an unencrypted, plain textual content kind. This methodology is helpful as a result of you need to use the identical port for each encrypted and plain textual content mail.

Enforced TLS (or Implicit TLS) requires the mail to be despatched over a safe connection. If the connection is just not encrypted, the mail might be blocked from sending. This methodology is way more safe than Opportunistic TLS, however does result in extra mail being dropped. 

Each approaches are broadly used within the electronic mail world, so contemplate what makes probably the most sense to your program. If you’re sending electronic mail that comprises delicate, private data, it could be greatest to make use of Enforced TLS. Then again, if you happen to’re sending non-sensitive materials, like advertising or promotions, you might be extra inclined to make use of Opportunistic TLS. 

Different TLS use instances

TLS is continuously used for encrypting a wide range of communication strategies outdoors of electronic mail. Since TLS is a comparatively easy, multi-step protocol, it makes it simple to regulate for a wide range of communication varieties. This contains net browsers, SMS, and Voice over IP. The truth is, quite a lot of firms use TLS to encrypt all communication between their net servers and browsers, even when nearly all of the communication isn’t delicate materials.

For extra data on how Twilio makes use of TLS, try Twilio’s Safety web page.

Why is StartTLS essential?

SMTP is just not secured by default, which implies that if you happen to had been to ship electronic mail over SMTP with out StartTLS the e-mail might be intercepted and simply interpreted. That is particularly worrisome when sending delicate, private data like usernames, passwords, or financial institution data. 

With out StartTLS, your private data is prone to being stolen. 

When an electronic mail shopper makes use of StartTLS, it informs the server that the content material should be encrypted. This manner, if the mail is intercepted, the content material has been scrambled and could be very difficult to decipher. The e-mail server and electronic mail shopper are the one ones that maintain the important thing to decode the message. 

Drawbacks

There are particular drawbacks to utilizing StartTLS. E mail shoppers are prone to man-in-the-middle assaults as a result of, within the preliminary connection between electronic mail shopper and server, the IP addresses will not be encrypted. 

Utilizing StartTLS might additionally add some latency to the SMTP connection. This could not be sufficient of a delay to make it essential to ship unencrypted electronic mail, however it’s good to remember.

How do I take a look at StartTLS?

It’s essential to check upfront to ensure the server is able to processing StartTLS. If it isn’t able to processing StartTLS you can by accident ship a good quantity of electronic mail that isn’t encrypted and is, due to this fact, prone to assault vectors.

Right here is an instance of how you’d take a look at StartTLS from SendGrid’s SMTP server.

How does Twilio SendGrid use StartTLS?

Twilio SendGrid helps TLS v1.1 and better. Unencrypted and TLS connections are accepted on ports 25, 587, and 2525. Or, you’ll be able to join by way of SSL on port 465. 

We observe Opportunistic TLS and ship on the best encryption stage the recipient server accepts. We additionally supply Enforced TLS. It’s your selection whether or not or not you require your electronic mail to be despatched over an encrypted connection. If the recipient server doesn’t settle for encrypted messages, the message is dropped and we ship a block occasion.

You’d primarily work together with StartTLS when initiating the SMTP request to Twilio SendGrid, asking to ship mail. In any other case, Twilio SendGrid handles the matching of the TLS certificates, the remainder of the encryption course of, and any points that will come up alongside the way in which.

For extra data on Twilio SendGrid and SMTP, head over to our docs article, The way to Ship an SMTP E mail. And once you’re prepared to begin sending emails, join a free Twilio SendGrid account and get began.