The NCSC-NL recommends that you ask your email provider to secure all their connections with STARTTLS and DANE

Ask your email provider to secure your email connections with DANE

Are you still sending your organisation’s secrets unprotected across the internet? Sanne Kamerling, NCSC-NL

Email is the technology of the future

Email is here to stay. Even though many alternatives have been proposed and implemented in the past decades, email is still extremely popular. Especially in a corporate context, it is hard to imagine getting any work done without your trusted inbox.

Email is worthy of protection, and worthy of your investments. Even if your private use of email has fallen over the past five years, chances are your business
will keep depending on email for years to come. Your organisation’s users exchange a wide array of sensitive information via email, ranging from intellectual property and strategic information to personally identifying information (PII).

Email functionality is both crucially important and remarkably uniform across deployments. Therefore, many organisations choose to outsource it to a specialized provider. Their expertise and advantages of scale lead to a more cost-effective and secure setup than most organisations could achieve on-premise.

Eavesdropping is easy when your email provider doesn’t protect their connections

Most connections to and from email providers can easily be eavesdropped upon. If an email provider sends your email to the email provider of another organisation, an attacker may read the email in transit anywhere between the two providers.

You may be entrusting your organisation’s secrets
to be safe in email, but the underlying protocol was never designed to secure such sensitive information. The protocol for email traffic, SMTP, dates back to 1982. Essentially, sending email today still works the same way it did in 1982. Today’s threats are much more advanced and numerous than in 1982. It’s hardly surprising that such an old protocol is not able to protect against them.

Some measures are available to mitigate this situation. Many email providers use STARTTLS to protect their connections to other providers. However, by itself STARTTLS is not an effective measure to counteract eavesdropping. An attacker who is willing to interfere with the connection can still read all emails that are sent over that connection. This is not just a theoretical risk. In 2015, researchers demonstrated that the STARTTLS protection to Google is stripped from more than twenty percent of all emails in seven countries. In certain cases, this percentage reached almost one hundred percent1. These emails were therefore sent unprotected across the internet.

End-to-end email encryption with S/MIME or OpenPGP is another measure that is sometimes used. While effective in theory, using these systems proves cumbersome and error-prone in practice. Most users do not bother with them at all, and even expert users only use them occasionally. Any real solution to the problem of email eavesdropping should therefore be transparent to users, in order to ensure that most if not all emails will be sent through protected connections.

Email security is about more than just protecting
the connections to- and from your email provider. Two-factor authentication, spoofing protection and antivirus all protect against different threats. However, none of these other measures are of any help when your email is plucked from the wire by an eavesdropping criminal organisation or foreign intelligence agency.

Ask your email provider to protect all its connections with STARTTLS and DANE
The NCSC-NL recommends that you ask your email provider to secure all their connections with STARTTLS and DANE. DANE is an internet standard that, combined with STARTTLS, prevents stripping attacks. If two email providers both use STARTTLS and DANE, an attacker cannot intercept email that is being send between these providers.

Online tests are available to check whether your email provider already protects their connections with STARTTLS and DANE. For full protection, your email provider needs to protect both incoming and outgoing connections. The email test on internet.nl2 checks whether your provider supports secure incoming connections for your email. The test on HaveDane3 checks whether your provider supports secure outgoing connections.

Implementing DANE in addition to STARTTLS is relatively cheap. Your email provider needs to publish some information about the way it has secured its incoming connections. For outgoing connections, it needs to modify its servers in order to the information that other email providers have published about the protection on their incoming connections.

There are some hurdles that your email provider may experience when implementing DANE and STARTTLS. For incoming connections, protection with DANE depends on the use of DNSSEC, another security technology. Support for DNSSEC should be considered a hygiene factor, but unfortunately not all email providers have currently implemented it yet. For outgoing connections, the email server software that your email provider uses, needs to support DANE. While the number of email server software vendors that support DANE is growing, support is by no means ubiquitous. We encourage your email provider to contact their vendor if they do not support DANE yet.

DANE is a relatively new standard, and the email ecosystem is slow to move. That is the primary reason the adoption of this standard has not skyrocketed yet. On the other hand, DANE is a mature technology that many organisations already use in production and
at scale. For example, it is compulsory for all Dutch government bodies to apply DANE when investing in email systems4. DANE’s benefits are available to any organisation that takes the trouble to implement it.

What does NCSC-NL do to further the adoption of DANE?
The NCSC-NL published their advice on implementing STARTTLS and DANE in a factsheet5. The advice

in this factsheet is aimed at people in a technical
role with regard to email connection security, such
as information security officers or email system administrators. It contains detailed instructions on how to implement DANE in an existing email environment. The factsheet is a valuable resource to share with your email provider and your internal IT department, to help them get a head start in implementing DANE.

Over the past few years, NCSC-NL has organized and participated in many initiatives to further the adoption of email security standards such as DANE. For example, the internet.nl online test is a product of the Dutch Internet Standards Platform, of which the NCSC-NL is
a member.

Additionally, the NCSC-NL is in close contact with several large vendors of email server software, to move them to support DANE in their software. This, for many organisations, is still the largest obstacle to take. By working together with these vendors to make this need visible, NCSC-NL hopes to achieve near-ubiquitous use of DANE in the coming years.