Should I have Secure transport (TLS) enabled for our emails?

[TwistedHelixis]

We already have DKIM setup but I wondered if others have TLS setup.

 

BTW we are using G Suite for Education.

[ZeroHour]

For clients connecting or sending mail after it hits googles servers?

Tbh it should be used for both.

[mavhc]

Yes, and don't allow email to be sent without it

[TwistedHelixis]

OK, so I assume I tick inbound & outbound in section 1. Do I need to change anything for section 2 & 3?

[mavhc]

tick outbound all messages, but monitor for those that fail

[timbo343]

I'm glad this cropped up. What happens if a mail servers fails TLS?

[mavhc]

then you can't send them email, and you shame them publicly

[timbo343]

then you can't send them email, and you shame them publicly

Would it fail during transmission with a NDR or would it not allow the sender to send the email?

[mavhc]

It would have to try to send first, so I assume it would email the sender back later saying it had failed

[TwistedHelixis]

tick outbound all messages, but monitor for those that fail

 

So don't tick inbound and leave everything else as it is in the screen grab?

[TwistedHelixis]

Also, if I tick outbound and then click test I get an error about no domains or addresses specified. Do they want me to list every domain or email address the school might contact, because that will never be practical.

[mavhc]

Can you just put *

[timbo343]

When i tested, wildcards don't work. I found that you have to add individual domains. It also doesn't like just gov.uk for example, you have to have the full domain (everything after the @) which in my eyes is a pain in the backside to manage.

[TwistedHelixis]

So is there no point setting up TLS as I am never going to know all the domains that the school might need to email

[timbo343]

Thats what my thought was too.

 

I have seen though when sending a new email the little padlock in the To field to that TLS is enabled.

[rogerdnixon]

For sending mail you can specify your domain. If you want to force TLS 1.2 or above you need to enable MTS-STS https://support.google.com/a/answer/9261504?hl=en

 

This takes a bit more setup - but not too hard and we have had it enforced for a while with few issues. It worth noting that TLS is enabled by default and the setting you are looking at simply causes mail to fail if the other end does not support it. The vast majority do now (CPOMS being a slightly ironic exception...).