SMTP Simple Mail Transfer Protocol Simple mail transfer protocol

To receive the mail the e-mail client needs to use POP3 protocols or Imap.Glavnoy a task of this protocol ensuring transfer of electronic messages (mail) is. For the organization of work with the help of the SMTP protocol the client carries out TCP connection with the server through port 25. After that there is information exchange between the client and the SMTP server until connection is not closed or will not be interrupted.

Stages of work of SMTP

• opening of transmission channel;
• mail transfer (Mail Procedure);
• procedure of a forvarding of mail (Mail Forwarding);
• check of names of a mailbox and output of lists of mail groups;
• closing of transmission channel.

The SMTP commands provide information to the server about transaction which the client wants to do. Commands are a key word which follows from one to several parameters. The key word includes four characters and is separated from an argument by one or several spaces. At the end of any command line characters of CRLF are put.

DMARC

Основная статья: DMARC (Domain-based Message Authentication, Reporting and Conformance)

In the basic transfer protocol of e-mail of SMTP there is a shortcoming: he does not allow to carry out authentication of external senders up to standard. Speaking to simple words, when sending the letter in the field of From it is possible to substitute any address. For example, the user who received the letter from mother cannot be sure that it was written by her. Counterfeit of email can be recognized, but for this purpose it is necessary to be technically grounded specialist: it is necessary to verify headings, the service information, the server and IP from which the letter arrived.

2002: STARTTLS expansion

The protocol drafted in 1982 for sending e-mail of SMTP does not support enciphering. It was invented when the Internet only developed, and need for protection of correspondence between only several thousand of computers connected to network was not.

In 2002 the STARTTLS expansion which allowed to send letters in encrypted form was developed for SMTP.

After in 2013 Edward Snowden told about acceptances of Agency of national security of the USA, enciphering gained popularity. In 2014 the Facebook social network sending billions of mail notifications a day found out that 58% of these notifications pass via secure channels. By August of the same year this digit increased up to 95%.

The STARTTLS expansion is used to this day, but it does not guarantee data protection as comprises a number of the defects allowing hackers to perform successfully the work.

Using expansion shortcomings, the malefactor can forge the mail server and convince the application on the PC or other mail server to send the message in the form of the plain text. It is possible to make it by forced failure from enciphering (in the normal mode such need can arise when the accepting server does not support enciphering) or by use of the counterfeit certificate.

2016: Google and Microsoft create the new SMTP, STS expansion (Strict Transport Security))

The group of independent researchers together with five companies is Google, Microsoft, Yahoo, Comcast and LinkedIn — in the spring of 2016 suggested to standardize new expansion for the SMTP protocol which will make e-mail more protected from interception. They sent the offer to the Internet Engineering Task Force (IETF) Google and Microsoft organization^[1].

Authors of an initiative suggested to create the STS expansion (Strict Transport Security) which will provide reliable authentication of participants of connection. In the theory of STS it is similar to the HSTS expansion for HTTPS. As well as HSTS, it should provide the ciphered exchange of office messages between the parties.

STS will guarantee safe connection and will define behavior of servers if the authenticity of one of them does not manage to be verified. What will be undertaken in this case, not specified.

The rules STS will be set by means of special DNS records which will be added to the domain of provider of a mail service.

It is supposed that it the person in the middle" when the malefactor has an opportunity to forge the second participant of connection will allow to protect users of e-mail from the attacks of a type "and to obtain its data.

You See Also

Notes

Description of the SMTP protocol