On 2023-03-29 at 04:46:17 UTC-0400 (Wed, 29 Mar 2023 10:46:17 +0200) Kirill Miazine via Exim-users <k...@krot.org> is rumored to have said:
Exactly. The former preventing passive data collection, the later -- active. Still, if *I* were to state a legal requirement that certain domains use TLS, I'd also ask for verification either via TLS or DANE, because just TLS is a very small win.
No, it's a huge win. All you get from demanding certificate verification is "protection" from sending mail as securely as possible to systems that are trivially misconfigured in ways that have been deemed tolerable for the whole history of encrypted mail transport.
Passive collection attacks are much easier and hence much less targeted than active collection, so requiring TLS without requiring certificate name validation moves your mail transport traffic from collectable by accidental big-net collection to requiring an attacker to know that they want YOUR traffic.
You also need to understand that requiring verification as a prerequisite for encryption has unintended consequences. If you only allow encryption with verification, you will either break deliverability entirely for some mail OR fall back to transport in the clear, *to the same unverifiable host* which cannot be anything but less safe.
-- Bill Cole b...@scconsult.com or billc...@apache.org (AKA @grumpybozo and many *@billmail.scconsult.com addresses) Not Currently Available For Hire -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
