CODEWITHSUNDEEP
c#emailsslencryption
Dexters
Dexters

Reputation: 2495

Validating TLS email reception

I am trying to convert our current email agent to send email with TLS. We use C# and I just used the following changes.

SmtpClient sclient = new SmtpClient();
sclient.EnableSsl = true;

and a callback method to validate server certificate.

On Testing the mail was sent/received successully, but both I and the receiving end cannot be 100% sure the the email was received encrypted. (I tried to use Fiddler but its not capturing the email)

Based on this http://luxsci.com/blog/how-you-can-tell-if-an-email-was-sent-using-tls-encryption.html, and the header as below

with ESMTP id s7JKErN9002462 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO);

Can we safely assume that the mail communication indeed was encrypted? or Should I make any other code changes so that I can be sure that the email is received or it failed? (I think this cannot be certain as it depends on the smtp host) ?

Upvotes: 0

Views: 394

Answers (2)

Maarten Bodewes
Maarten Bodewes

Reputation: 94018

In the end you can always check the TLS connection using network sniffer software such as WireShark.

Of course if you only leave a connection open to the SSL port of the server, and you receive the server certificate, you can be pretty certain the mail did not appear from the blue sky anyway.

Upvotes: 1

Nick DeVore
Nick DeVore

Reputation: 10166

You can safely assume that if you are able to connect and send, that the tunnel you're delivering the mail to is secure.

The SmtpClient code is solid and you can trust it. If it fails to connect securely after you've asked it to, it throws an exception, so you'll know something is not like you were expecting.

Upvotes: 1

Related Questions