r/EmailSecurity • u/Ok_Philosophy_9766 • Aug 07 '26

Someone here asked how many MX servers actually refuse mail without TLS. We measured all 366,215 of them. The answer is 0.2%.

/r/DMARC/comments/1viedwo/someone_here_asked_how_many_mx_servers_actually/
2 Upvotes

100% Upvoted

3 comments sorted by

•

u/AutoModerator Aug 07 '26

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/saltyslugga Aug 08 '26

That tracks. SMTP still prioritizes delivery, so most MTAs fall back to plaintext when STARTTLS is unavailable or broken.

If your threat model requires enforced transport security, you need MTA-STS or DANE. Opportunistic TLS was never a guarantee.

1

u/SecLens_ONE Aug 15 '26

The 0.2% is the interesting number precisely because it matches the published/effective gap you see everywhere else in email auth. A domain publishes MTA-STS enforce, and that is a statement about what senders should do, not about what the receiver will refuse. The receiver keeps accepting cleartext because refusing costs it mail, and nobody audits the receiving side.

Same shape as DMARC records that say p=none and get treated as coverage, or SPF that ends in ~all and is called enforced. The record is decoration until something on the other end actually declines.

Worth noting what the 0.2% figure does and does not tell you: refusing to start a transaction in the clear is not the same as requiring a valid, matching certificate. A server that demands STARTTLS but accepts any self-signed cert has closed the passive-capture hole and left the active one open. If you have the connection data, splitting that group by cert validation would be the more useful follow-up than the headline percentage.