Transport Layer Security (TLS) peers

Views:

Transport Layer Security (TLS) is a protocol that helps to secure data and ensure communication privacy between endpoints. Cloud Email Gateway Protection allows you to configure TLS encryption policies between Cloud Email Gateway Protection and specified TLS peers. Cloud Email Gateway Protection supports the following TLS protocols in descending order of priority: TLS 1.3, TLS 1.2, TLS 1.1 and TLS 1.0.

To prevent against man-in-the-middle attacks on TLS connections, Cloud Email Gateway Protection introduces DNS-based Authentication of Named Entities (DANE) and Mail Transfer Agent - Strict Transport Security (MTA-STS) to verify the identity of the destination servers.

Note

You can enable DANE or MTA-STS authentication between Cloud Email Gateway Protection and specified TLS peers during outbound mail delivery.

For inbound mails, Cloud Email Gateway Protection inherently supports MTA-STS after you have set up a DNS record and a policy for your domain. For details, see About mta-sts records for inbound protection.

The Transport Layer Security (TLS) Peers screen uses the following important terms:

Term

Details

Managed Domain list

Status (Managed Domain)

Enabled: Domain is enabled
Disabled: Domain is disabled

Default (for unspecified domains)

This configuration applies to all domains that are not in the managed domain list

Domain TLS Peers list

Status (TLS Peer)

Enabled: Cloud Email Gateway Protection applies your specified TLS configuration to the peer
Disabled: Cloud Email Gateway Protection does not apply your specified TLS configuration to the peer

Instead, the Default (for unspecified peers) TLS configuration applies.

TLS peer

Cloud Email Gateway Protection can apply your specified TLS configuration with this peer during network communications.

Minimum TLS version

Minimum TLS version that the TLS peer must use to communicate with Cloud Email Gateway Protection through the TLS protocol.

TLS 1.3: The TLS peer must use TLS 1.3.
TLS 1.2: The TLS peer must use TLS 1.2 or later.
No restriction: The TLS peer can use any TLS protocol.

Security level

Opportunistic TLS:
- Communicates using encryption if the peer supports and elects to use TLS
- Communicates without encryption if the peer does not support TLS
- Communicates without encryption if the peer supports TLS but elects not to use TLS
Mandatory TLS:
- Communicates using encryption if the peer supports and elects to use TLS
- Does not communicate if the peer does not support TLS
- Does not communicate if the peer supports TLS but elects not to use TLS
Opportunistic DANE TLS (Outbound protection only)
- Communicates using encryption only if remote SMTP server has usable DANE TLSA record(s) and the peer DANE authentication succeeds
- Downgrades to Mandatory TLS if all TLSA record(s) are unusable due to unsupported parameters or malformed data
- In other cases, downgrades to Opportunistic TLS
Mandatory DANE TLS (Outbound protection only)
- Communicates using encryption if the peer DANE authentication succeeds
- Does not communicate if the peer does not pass DANE authentication
MTA-STS (Outbound protection only)
- Delivers the message using encryption when the TLS peer uses the policy mode enforce or testing and passes MTA-STS validation
- Does not deliver the message when the TLS peer uses the policy mode enforce but fails the MTA-STS validation
- Uses Opportunistic TLS to deliver the message when the policy of the TLS peer cannot be obtained, the TLS peer uses the policy mode none, or the TLS peer uses the policy mode testing but fails the MTA-STS validation

Note

When a TLS peer supports both DANE and MTA-STS, Trend Micro recommends that you select DANE for communicating with the peer. DANE is considered more secure than MTA-STS for protecting SMTP connections.

Default (for unspecified peers)

This configuration applies to all peers that meet any of the following criteria:

Peer is not in the peer list
Peer is in the peer list, but is not enabled