dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
14.85k stars 4.62k forks source link

Support implicit TLS for SMTP client #71304

Open M144-Coder opened 2 years ago

M144-Coder commented 2 years ago

According to the SMTP client documentation the SmtpClient class supports STARTTLS (Explicit SSL/TLS) and there is no support support for implicit TLS.

There are several issue with STARTTLS:

1-According to RFC 8314 STARTTLS is depreciated and the recommended way is implicit TLS. 2- STARTTLS allows clients to switch to clear text which is a huge problem. 3-A lot of mail servers, firewalls and service providers block port 25 for various reasons and this port is used at first to start STARTTLS.

Implicit TLS is the way to go, please consider adding support for it.

ghost commented 2 years ago

Tagging subscribers to this area: @dotnet/ncl, @vcsjones See info in area-owners.md if you want to be subscribed.

Issue Details
According to the [SMTP client documentation](https://docs.microsoft.com/en-us/dotnet/api/system.net.mail.smtpclient.enablessl?view=net-6.0) the SmtpClient class supports STARTTLS (Explicit SSL/TLS) and there is no support support for implicit TLS. There are several issue with STARTTLS: 1-According to [RFC 8314](https://www.rfc-editor.org/rfc/rfc8314) STARTTLS is depreciated and the recommended way is implicit TLS. 2- STARTTLS allows clients to switch to clear text which is a huge problem. 3-A lot of mail servers, firewalls and service providers block port 25 for various reasons and this port is used at first to start STARTTLS. Implicit TLS is the way to go, please consider adding support for it.
Author: M144-Coder
Assignees: -
Labels: `area-System.Net.Security`
Milestone: -
teo-tsirpanis commented 2 years ago

SmtpClient is in maintenance mode and not getting new features. You are encouraged to move to a library such as MailKit which I think supports implicit TLS.

karelz commented 2 years ago

Triage: As mentioned above, this is maintenance mode. We would take a high-quality contribution in the space though.