Re: [Bloat] STARTTLS [was: nearly 5 years of bufferbloat.net]

["Dave Täht" <dave@taht.net>]

On 1/27/16 9:16 AM, Juliusz Chroboczek wrote:
>> http://the-edge.taht.net/post/starttls_considered_helpful/
> 
> Did you bounce mail when the first MX contacted didn't do STARTTLS, or did
> you bounce when none of the MXes for a domain supported it?  In other
> words, did you treat lack of STARTTLS as a transient or permanent error?

Postfix when set to encrypt always treats lack of TLS support on the
other exchanger(s) as a transient error, and retries by default for 3
days.

Example:

Jan 27 17:16:11 mail postfix/smtp[10770]: 801CD21331:
to=<oneofmystillannoyedcorrespondents@conman.org>,
relay=brevard.conman.org[elided]:25, delay=67644, delays=67640/0.01/4/0, dsn
=4.7.4, status=deferred (TLS is required, but was not offered by host
brevard.conman.org[elided])

So this made it safer to temporarily make it mandatory, do email for a
few hours, get who failed out of my logs, craft the email to those
failing, then relax the defaults for starttls back to "may".

google reports that 82% of their outbound email and only 58% of their
inbound email is covered by starttls, and there are distinct regional
differences... notably, free.fr in your region is not using starttls on
inbound at all, it seems.  Ton of data at:

https://www.google.com/transparencyreport/saferemail/

And sadly, the growth curve for uptake in the past year appears flat.