Is there a way to verify if e-mail was delivered only using SSL connection?

Question

I have my own mail server, which is listening on both unsecured and SSL / TLS ports. My question is, when I receive an e-mail, is there any way to verify if the mail, on its way from original server to my mail server, was delivered using unsecured connection? (anywhere - even server to server connection).

I tried checking the mail source and header only contains which server delivered it to which server on its way to my mail client, but it doesn't contain which protocol was used and whether it was using SSL or not.

Answer 1

First, server-to-server delivery happens only over port 25 and no other. If the servers both want TLS, they will enable "STARTTLS" over the same port 25. They will not use the (long ago deassigned, by the way) SMTPS port 465 for anything.

Regarding intermediate hops, the message source is all you have – the Received headers, specifically. Some mail servers do attach verbose information about the TLS connection (down to the cipher used), others just mention SMTPS, yet others say nothing at all.

It's possible that some hops will say "SMTP" because they were internal datacenter hops and the admins chose IPsec instead (or didn't care at all). It's possible that some hops didn't use SMTP at all, but HTTP (webmail) or custom internal mail shuffling protocols; the "Received" annotations vary greatly. In particular, there's often no mention at all of whether a webmail user was using HTTPS.

For example, this says ESMTPSA – it means ESMTP (extended/EHLO SMTP) was used, over a secure (S – STARTTLS) connection.

Received: from note.local.net
 by minnie.tuhs.org (Postfix) with ESMTPSA id DF028A5460;
 Mon, 14 Dec 2015 21:01:29 +1000 (AEST)

(The message went through four hops total, 2 were using TLS, 2 weren't.)

Regarding the last hop (i.e. your own server), you can also check the SMTP service's log files (e.g. /var/log/exim/mainlog or /var/log/mail.log). If you search for the specific queue ID like DF028A5460, you'll usually find a mention some level of TLS-related information several lines above it.