https://blogs.damiendye.uk/en/tags/starttls/ Recent content in Starttls on Damien Dye's Blog Hugo en-GB Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Email transport security fails open: a stripped STARTTLS, a stale TLSA record, an unsigned zone or a p=none policy, and mail drops to cleartext or forgeable delivery with nothing telling you. A lab man-in-the-middle, the seven settings and how each fails when wrong, DNSSEC up to DANE, and a census of the banks, providers and CAs.