What’s StartTLS? – SendGrid

Ever marvel how electronic mail is securely despatched from one server to a different? When utilizing Easy Mail Switch Protocol (SMTP) to ship mail, we depend on a mix of StartTLS and Transport Layer Safety (TLS) or Safe Sockets Layer (SSL) to encrypt our mail and assist it safely land within the inbox. 

However what’s StartTLS?

StartTLS is a protocol command used to tell the e-mail server that the e-mail consumer needs to improve from an insecure connection to a safe one utilizing TLS or SSL. StartTLS is used with SMTP and IMAP, whereas POP3 makes use of the marginally completely different command for encryption, STLS. 

We’ll dig into the variations between TLS and SSL, the StartTLS course of, and find out how to check StartTLS in your program. 

How does StartTLS work?

TLS vs. SSL

Although “TLS” is in its title, StartTLS works with each encryption protocols, TLS and SSL. 

Whereas StartTLS works with each protocols, we advocate utilizing TLS over SSL. SSL is an older protocol and isn’t as safe as its successor, TLS. SSLv2 and SSLv3 have each been deprecated.

For reference, right here’s an inventory of SSL and TLS protocols from oldest to latest: 

SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3 

Each the e-mail consumer and electronic mail server must agree on what connection to make use of. The e-mail consumer might help TLSv1.3, however the electronic mail server might solely help as much as TLSv1.2. Because of this each events might want to use TLSv1.2 to proceed with the encryption.

For much more info on TLS vs. SSL, try our docs web page.

The StartTLS course of

SMTP at all times begins unencrypted. The StartTLS command begins the negotiation between server and consumer. Right here’s an overview of the communication that occurs between the e-mail consumer and electronic mail server.

1. The method begins with the Transmission Management Protocol (TCP) handshake to assist each the e-mail consumer and server establish one another.
2. The server identifies with 220 Prepared that the e-mail consumer can proceed with the communication.
3. The consumer sends the server “EHLO” to tell the server that the consumer wish to use Prolonged SMTP (the extra superior model of SMTP that permits you to embrace photos, attachments, and many others.).
4. The consumer sends “250-STARTTLS” to the mail server to ask whether or not or not StartTLS is accepted.
5. If the server sends again “go head,” the StartTLS connection will be created. 
6. The consumer restarts the connection and the e-mail message has been encrypted.

Right here’s a visible illustration of the StartTLS course of.

Which port must you use?

The port that makes use of StartTLS most frequently is port 587. It typically requires electronic mail purchasers to make use of StartTLS to ship mail. Different ports used to ship encrypted mail are 25, 465, and 2525. Since port 25 was designed for mail switch, not submission, your ISP might block electronic mail despatched via this port. Port 465 is the second mostly used port for StartTLS.

Opportunistic vs. Enforced TLS

There are a few alternative ways to arrange your electronic mail encryption program through the use of both Opportunistic TLS or Enforced TLS:

Opportunistic TLS (or Specific TLS) permits the e-mail consumer to ship on the very best encryption degree the recipient server accepts. If the recipient server doesn’t settle for TLS, the e-mail consumer will negotiate with the server and conform to downgrade to an unencrypted connection. The message will then be despatched in an unencrypted, plain textual content type. This technique is helpful as a result of you should utilize the identical port for each encrypted and plain textual content mail.

Enforced TLS (or Implicit TLS) requires the mail to be despatched over a safe connection. If the connection isn’t encrypted, the mail will likely be blocked from sending. This technique is way more safe than Opportunistic TLS, however does result in extra mail being dropped. 

Each approaches are broadly used within the electronic mail world, so contemplate what makes essentially the most sense in your program. In case you are sending electronic mail that incorporates delicate, private info, it might be greatest to make use of Enforced TLS. Alternatively, for those who’re sending non-sensitive materials, like advertising and marketing or promotions, it’s possible you’ll be extra inclined to make use of Opportunistic TLS. 

Different TLS use instances

TLS is ceaselessly used for encrypting a wide range of communication strategies outdoors of electronic mail. Since TLS is a comparatively easy, multi-step protocol, it makes it straightforward to regulate for a wide range of communication sorts. This consists of net browsers, SMS, and Voice over IP. The truth is, loads of firms use TLS to encrypt all communication between their net servers and browsers, even when the vast majority of the communication isn’t delicate materials.

For extra info on how Twilio makes use of TLS, try Twilio’s Safety web page.

Why is StartTLS necessary?

SMTP isn’t secured by default, which signifies that for those who have been to ship electronic mail over SMTP with out StartTLS the e-mail may very well be intercepted and simply interpreted. That is particularly worrisome when sending delicate, private info like usernames, passwords, or financial institution info. 

With out StartTLS, your private info is prone to being stolen. 

When an electronic mail consumer makes use of StartTLS, it informs the server that the content material have to be encrypted. This manner, if the mail is intercepted, the content material has been scrambled and may be very difficult to decipher. The e-mail server and electronic mail consumer are the one ones that maintain the important thing to decode the message. 

Drawbacks

There are particular drawbacks to utilizing StartTLS. E-mail purchasers are inclined to man-in-the-middle assaults as a result of, within the preliminary connection between electronic mail consumer and server, the IP addresses aren’t encrypted. 

Utilizing StartTLS may additionally add some latency to the SMTP connection. This could not be sufficient of a delay to make it essential to ship unencrypted electronic mail, however it’s good to remember.

How do I check StartTLS?

It’s necessary to check prematurely to ensure the server is able to processing StartTLS. If it isn’t able to processing StartTLS you might by accident ship a good quantity of electronic mail that isn’t encrypted and is, due to this fact, inclined to assault vectors.

Right here is an instance of how you’ll check StartTLS from SendGrid’s SMTP server.

How does Twilio SendGrid use StartTLS?

Twilio SendGrid helps TLS v1.1 and better. Unencrypted and TLS connections are accepted on ports 25, 587, and 2525. Or, you’ll be able to join via SSL on port 465. 

We comply with Opportunistic TLS and ship on the very best encryption degree the recipient server accepts. We additionally supply Enforced TLS. It’s your alternative whether or not or not you require your electronic mail to be despatched over an encrypted connection. If the recipient server doesn’t settle for encrypted messages, the message is dropped and we ship a block occasion.

You’ll primarily work together with StartTLS when initiating the SMTP request to Twilio SendGrid, asking to ship mail. In any other case, Twilio SendGrid handles the matching of the TLS certificates, the remainder of the encryption course of, and any points which will come up alongside the way in which.

For extra info on Twilio SendGrid and SMTP, head over to our docs article, How you can Ship an SMTP E-mail. And whenever you’re prepared to start out sending emails, join a free Twilio SendGrid account and get began.