Visual RFC.
ALL RFCs / RFC 3207
Read the RFC ↗
RFC 3207 / SMTP STARTTLS

Bound protection to a hop and a service policy

05

Mail may cross several SMTP connections. Protecting one connection does not protect earlier traffic, every later hop, stored messages or the message author’s identity.

DIAGRAMRead RFC section 6 ↗
RFC 3207 · § 6EXAMPLE
5 / 5
Bound protection to a hop and a service policyFive scoped comparisons. Only relayA to relayB has accepted TLS protection; next hop is initially unassessed, then a separate later plaintext link exposes that traffic despite earlier protection. An active intermediary can strip STARTTLS from cleartext EHLO. Selected-host TLS-required policy stops plaintext MAIL when protection is missing; RFC3207requires configurable selected-host policy and recommends a use-when-possible option, while remembering past TLS and warning is MAY. Finally publicMX port25 local delivery MUST NOT require STARTTLS under RFC3207, whereas a separate nonpublic service can require it and SHOULD use530exceptNOOP,EHLO,STARTTLS,QUIT. Later8314submission/access guidance has separate scope. Hop peer authentication is not message-author authentication.One protected hop is not the whole mail pathPublic MX · port 25 · local deliveryMUST NOT require STARTTLS (RFC 3207)Separate non-public service · TLS required530 for other commands (SHOULD)Except NOOP / EHLO / STARTTLS / QUITSubmission/access: also consult RFC 8314This is not advice to submit mail in cleartext
05
Keep public reception and submission scopes distinct.

Publicly referenced port-25 local delivery has the RFC 3207 MUST NOT-require rule. A separate non-public service can require TLS first and return 530 for other commands; later submission/access guidance must also be consulted.

Source for this drawing: RFC 3207 · Read RFC section 6 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 5321 SMTP RFC 8446 TLS 1.3 RFC 5280 X.509 certificates

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Keep hop protection, downgrade policy and submission rules separate.

  • TLS privacy on one client/server pair does not make the whole mail-delivery chain private. Authenticating a connecting SMTP peer alone does not authenticate the email’s author.
  • An attacker can strip STARTTLS from the cleartext EHLO exchange. Clients and servers MUST be configurable to require successful TLS with an appropriate cipher suite for selected hosts; using TLS when possible SHOULD also be an option.
  • RFC 3207 says a publicly referenced port-25 SMTP receiver MUST NOT require STARTTLS for local delivery. Any server may refuse relay based on TLS authentication; non-public servers may also refuse local delivery on that basis.
  • A non-public server that requires TLS before other commands SHOULD return 530 except for NOOP, EHLO, STARTTLS and QUIT; with enhanced status codes, 5.7.0 SHOULD be used.
DETAILS

Publicly referenced here means the destination domain’s MX-selected port-25 receiver (or address fallback with no MX), not every Internet-reachable SMTP server. This local-delivery rule is not advice to submit mail in cleartext. Later RFC 8314 provides submission/access guidance, including implicit TLS. Verified erratum 324 supplies RFC 1847 as the missing MIME security reference; message protection is separate from this hop upgrade. Rejected erratum 4442 is not applied as a correction.

Read the RFC section ↗

All chapters in RFC 3207

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗