This commit is contained in:
Dennis Baaten 2019-10-29 14:55:23 +01:00 committed by GitHub
parent fce04acf60
commit 5fe83291ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -89,7 +89,7 @@ The risks of SMTP with opportunistic TLS can be mitigated by using DANE:
In short: DANE allows sending mail servers to unconditionally require STARTTLS with a matching certificate chain. Otherwise, the sending mail server aborts the connection and tries another server or defers the message. Receiving servers with published TLSA records, are therefore no longer vulnerable to the afore mentioned man in the middle attacks. In short: DANE allows sending mail servers to unconditionally require STARTTLS with a matching certificate chain. Otherwise, the sending mail server aborts the connection and tries another server or defers the message. Receiving servers with published TLSA records, are therefore no longer vulnerable to the afore mentioned man in the middle attacks.
## How about MTA-STS? ## How about MTA-STS?
Internet.nl currently does not include MTA-STA in its tests. This paragraph explains why this is the case. Internet.nl currently does not include MTA-STS in its tests. This paragraph explains why this is the case.
First you need to understand that, as [explained on our website](https://en.internet.nl/faqs/report/), the selection and development of tests performed by internet.nl is primairily based on: First you need to understand that, as [explained on our website](https://en.internet.nl/faqs/report/), the selection and development of tests performed by internet.nl is primairily based on:
* the [comply-or-explain list](https://www.forumstandaardisatie.nl/open-standaarden) of the Dutch Standardisation Forum which is mandatory for all Dutch government agencies; * the [comply-or-explain list](https://www.forumstandaardisatie.nl/open-standaarden) of the Dutch Standardisation Forum which is mandatory for all Dutch government agencies;