cisagov / trustymail

Scan domains and return data based on trustworthy email best practices
Creative Commons Zero v1.0 Universal
189 stars 31 forks source link

Trustymail can't directly verify mail servers. #64

Open mmclean636jr opened 6 years ago

mmclean636jr commented 6 years ago

Can mail servers directly be inputted into this tool?

I have domains that have MX records and are reported as "Supports STARTTLS = FALSE" but when I log into the actual mail server and run an EHLO for services offered "250-STARTTLS" pops up.

Domain: airs1.jpl.nasa.gov Mail Servers: ppa01.jpl.nasa.gov, ppa02.jpl.nasa.gov

Domain MX Results:
; <<>> DiG 9.8.3-P1 <<>> MX airs1.jpl.nasa.gov
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7860
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;airs1.jpl.nasa.gov.        IN  MX

;; ANSWER SECTION:
airs1.jpl.nasa.gov. 599 IN  MX  20 ppa02.jpl.nasa.gov.
airs1.jpl.nasa.gov. 599 IN  MX  20 ppa01.jpl.nasa.gov.

;; Query time: 89 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Feb  7 11:50:39 2018
;; MSG SIZE  rcvd: 80

Mail Servers TelNet Results:

ppa01.jpl.nasa.gov::

MMcLeans-MacBook-Air:~ mmclean$ telnet ppa01.jpl.nasa.gov 25
Trying 128.149.137.112...
Connected to ppa01.jpl.nasa.gov.
Escape character is '^]'.
220 ppa01.jpl.nasa.gov ESMTP Wed,  7 Feb 2018 08:51:46 -0800
EHLO airs1.jpl.nasa.gov
250-ppa01.jpl.nasa.gov Hello 50-249-39-20-static.hfc.comcastbusiness.net [50.249.39.20], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250 STARTTLS

ppa02.jpl.nasa.gov::

MMcLeans-MacBook-Air:~ mmclean$ telnet ppa02.jpl.nasa.gov 25
Trying 128.149.137.113...
Connected to ppa02.jpl.nasa.gov.
Escape character is '^]'.
220 ppa02.jpl.nasa.gov ESMTP Wed,  7 Feb 2018 08:52:26 -0800
EHLO airs1.jpl.nasa.gov
250-ppa02.jpl.nasa.gov Hello 50-249-39-20-static.hfc.comcastbusiness.net [50.249.39.20], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250 STARTTLS

What could cause this issue?

jsf9k commented 6 years ago

@mmclean636jr, are the servers in question Cisco IronPort servers?