Microsoft is working to add SMTP MTA Strict Transport Security (MTA-STS) support to Exchange Online to ensure the security and integrity of Office 365 customers' email communications.
Once MTA-STS is available in Office 365 Exchange Online, email messages sent by users through Exchange Online will be delivered only over authenticated and encrypted connections, protecting against both email interception and attacks.
Protection against MITM attacks and downgrades
MTA-STS enhances Exchange Online email security and resolves many SMTP security issues, such as lack of support for secure protocols, expired TLS certificates , and certificates not issued by trusted third parties or corresponding server domain names.
Since mail servers will still send emailseven though a secure TLS connection cannot be established , SMTP connections are exposed to various attacks, such as downgrade and man-in-the-middle.
“Downgrade attacks are possible where the STARTTLS response can be stripped, rendering the message in clear text,” Microsoft says. “Man-in-the-middle (MITM) attacks are also possible, where the message can be redirected to an attacker ’s server .”
"MTA-STS (RFC8461) helps prevent such attacks by providing a mechanism for defining domain policies that determine whether the received domain supports TLS and what to do when TLS cannot be negotiated," the company explains in an update for Microsoft 365.
“The Exchange Online (EXO) outbound mail flow now supports MTA-STS,” Microsoft also adds.
Exchange Online SMTP MTA Strict Transport Security (MTA-STS) support is in development, and the company plans to make it generally available in December across all environments, for all Exchange Online users.
