ESA SMTP TLS

[cyberurmel]

Hello there, 

just perhaps a few simple questions for the professionals - could you be so kind to answer ? 

Mailsettings at moment : 

TLS 1.1  1.2 preferred for in and outbound 

questions : 

- anyone know when 1.3 is offered in ESA

- can i see how much from the incoming are using 1.1 instead of 1.2? 

i only find encrypted in summary . 

is it useful or best practices currently to disable 1.1 and set expected instead of preferred? 

thanks a lot 

Regards

[Ken Stieers · Accepted solution]

The last roadmap I saw said 2H2023 (fiscal year, so... Aug?) They know that reporting on TLS1.1/1.2 etc. is weak, and more detailed reporting is coming, probably same time frame..
In the mean time you can look at your mail logs, they have the detail you're looking for.
I would check your logs for the past 6months... if no-one is using TLS1.1, you're probably safe turning it off...

[cyberurmel]

Hi Ken,



thanks a lot..



so i found nothing with

grep "TLSv1.1" mail_logs and a flood with grep "TLSv1.2" mail_logs



so you think that's an useful indicator to switch only to 1.2?

And as addon ..what do you think is better way - to accept only 1.2 or fallback to not encrypted? As I can see currently about 10 % is not encrypted.



Best Regards

[dukebox]

Any news on this potential better reporting for TLS (or no TLS) and cipher used as we are moving out of TLS1.0, 1,1,1,2 and now 1,3 ?

That would be really valuable to investigate and detect non-compliant senders! even more with YAHOO and GOOGLE enforcing TLS and DMARC compliance

ref : https://dmarcian.com/yahoo-and-google-dmarc-required/