search

ScottPeterJohnson / purelymail-issues

Issues repository for the Purelymail email service.
32 stars 0 forks source link

DNSSEC, and DANE support #124

Open GreenBeard opened 1 year ago

GreenBeard commented 1 year ago

I'm not an expert on email, but my basic understanding is that normally server to server emails aren't very secure, and that as certain features of DMARC, DKIM, and SPF rely upon accurate DNS records they are vulnerable to the many attacks against DNS infrastructure unless DNSSEC is used. Further my understanding of server to server email encryption is that it is by default opportunistic, and therefore vulnerable to downgrade attacks. I would also therefore like to request support for DANE to ensure that no one can read email messages in transit between servers (for example Microsoft is slowly adding support for this to the emails that they manage https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920).

I apologize if this should really be separated into two issues instead of one (I can do that if you want, or feel free to do it yourself). The issues seemed connected enough to be worth posting together to me.

Edit: see https://dnsviz.net/d/purelymail.com/dnssec/

ScottPeterJohnson commented 1 year ago

I'd be happy to implement DANE, though I'm not sure what it'd require yet or how it's different from MTA-STS, which seems to do some of the same thing. As far as I can tell, DANE might actually work without requiring us to procure an SSL record for customer domains yet, which is nice, though it seems like the DANE record might have to update every time our SSL certificate changes? Not sure.

Route53 does seem to support DNSSEC now, so enabling that might be pretty easy, at least for ultimate DNS records hosted by us. I'll take a look at that soon; I'm not sure if there are any gotchas there.

ebblake commented 7 months ago

In addition to DNSSEC and DANE, https://internet.nl/mail/purelymail.com/1082679/ also recommends that you add an AAAA record for IPv6 connectivity, and that you tweak TLS settings to use a stronger hash.

catharsis71 commented 6 months ago

just enabling DNSSEC would be a great benefit even if you do nothing else, and is generally quite easy to do, especially if your domain registrar is also your DNS provider, which it appears to be for purelymail.com. they might have a one-button setup, otherwise it's like a 2-minute setup, copy/pasting a few values from the registrar to the DNS provider

DANE is more complicated to set up

Kreeblah commented 2 months ago

I'd really like to see DNSSEC support added to purelymail.com as well, especially since it should be pretty easy to set up as long as your DNS host supports it. It's something that really does just take a few minutes to do.

DANE would be nice, too, but it looks like it would require more active maintenance unless you can automate it when you rotate the mail server's TLS cert.