Update settings for cc9.ne.jp #101
Conversation
| <port>465</port> | ||
| <socketType>SSL</socketType> |
There was a problem hiding this comment.
question: The documentation (https://www.cc9.jp/support/internet/software/mail/thunderbird.html, as well as https://www.cc9.jp/support/internet/software/mail/imap.html) say to use port 587 with STARTTLS. Where possible, I think it might be best to stick to what's publicly documented to limit the likelihood of unexpected breakage (even though STARTTLS is a bit less secure). Do we have a policy of preferring SSL instead of SMARTTLS, even when SSL is not part of the provider's documentation?
For additional context, it looks like none of ISPDB advertises SMARTTLS, although https://www.bucksch.org/1/projects/thunderbird/autoconfiguration/config-file-format.html says we support it, and Thunderbird seems to also support it.
There was a problem hiding this comment.
(I'm assuming "SMARTTLS" is a typo and is meant to be read as "STARTTLS")
We haven't properly documented this. But for ISPDB we do prefer implicit TLS (instead of STARTTLS) even when that is not documented by the provider (of course only if the server responds on the relevant port). The reason is mostly this research: https://nostarttls.secvuln.info/ (see also this FOSDEM talk: https://fosdem.org/2024/schedule/event/fosdem-2024-2179--protocols-security-of-starttls-in-the-e-mail-context/)
We could list both the implicit and explicit TLS options. However, I don't know of any email client that supports autoconfig, but only one method and not the other. So I opted to only include the implicit TLS config.
There was a problem hiding this comment.
(I'm assuming "SMARTTLS" is a typo and is meant to be read as "STARTTLS")
bleh, sorry, yes I meant STARTTLS 🤦
Fair enough then!
| <port>465</port> | ||
| <socketType>SSL</socketType> |
There was a problem hiding this comment.
(I'm assuming "SMARTTLS" is a typo and is meant to be read as "STARTTLS")
bleh, sorry, yes I meant STARTTLS 🤦
Fair enough then!
Mail servers can be reached using these settings. Due to lack of an account I wasn't able to test authentication. But what we have now is more likely to work than what was there before.