Description
Webtop serves a Thunderbird autoconfiguration file at
https://webtop.nethesis.it/mail/config-v1.1.xml. That file still advertises the
legacy ports with STARTTLS:
- IMAP on port 143, socketType STARTTLS
- SMTP on port 587, socketType STARTTLS
Implicit TLS is now the recommended setting. RFC 8314 (2018) recommends implicit
TLS in preference to STARTTLS on the cleartext port, because it has been deployed
more successfully and makes TLS usage more consistent across clients.
The RFC does not ask to drop the STARTTLS ports. Section 4 says to keep them in
the near term, for compatibility with existing client configurations. This only
changes what we advertise.
Thunderbird already detects this on its own. When a user types an address, the
account setup wizard proposes IMAP 993 and SMTP 465 with SSL/TLS, which does not
match what we publish. Our own Outlook autodiscover file
(autodiscover.xml) already uses 993 and 465 with SSL enabled, so the two files
we ship disagree with each other.
The change is to update the Thunderbird template so it advertises:
- IMAP on port 993, socketType SSL
- SMTP on port 465, socketType SSL
Who benefits: every user setting up a mail client against a NethServer 8 mail
server. They get an encrypted connection from the first packet, and no downgrade
is possible.
File to update: imageroot/templates/autoconfiguration/config-v1.1.xml in
ns8-webtop.
Both ports are already open and serving TLS on ns8-mail, so no server side change
is needed. STARTTLS on 143 and 587 keeps working for existing clients, we only
stop recommending it.
The documentation should be updated too, since the manual and the training
material still recommend the STARTTLS ports.
Alternative solutions
Publish both options and let the client choose. The Mozilla autoconfig schema
allows several incomingServer entries. I rejected it because the first entry
wins in practice, and shipping the legacy ports as a fallback keeps recommending
something we want to move away from.
Leave the file as it is and rely on Thunderbird guessing the right ports. I
rejected it because other clients do not guess, and because a wrong published
value is worse than no value.
References
Description
Webtop serves a Thunderbird autoconfiguration file at
https://webtop.nethesis.it/mail/config-v1.1.xml. That file still advertises thelegacy ports with STARTTLS:
Implicit TLS is now the recommended setting. RFC 8314 (2018) recommends implicit
TLS in preference to STARTTLS on the cleartext port, because it has been deployed
more successfully and makes TLS usage more consistent across clients.
The RFC does not ask to drop the STARTTLS ports. Section 4 says to keep them in
the near term, for compatibility with existing client configurations. This only
changes what we advertise.
Thunderbird already detects this on its own. When a user types an address, the
account setup wizard proposes IMAP 993 and SMTP 465 with SSL/TLS, which does not
match what we publish. Our own Outlook autodiscover file
(
autodiscover.xml) already uses 993 and 465 with SSL enabled, so the two fileswe ship disagree with each other.
The change is to update the Thunderbird template so it advertises:
Who benefits: every user setting up a mail client against a NethServer 8 mail
server. They get an encrypted connection from the first packet, and no downgrade
is possible.
File to update:
imageroot/templates/autoconfiguration/config-v1.1.xmlinns8-webtop.
Both ports are already open and serving TLS on ns8-mail, so no server side change
is needed. STARTTLS on 143 and 587 keeps working for existing clients, we only
stop recommending it.
The documentation should be updated too, since the manual and the training
material still recommend the STARTTLS ports.
Alternative solutions
Publish both options and let the client choose. The Mozilla autoconfig schema
allows several
incomingServerentries. I rejected it because the first entrywins in practice, and shipping the legacy ports as a fallback keeps recommending
something we want to move away from.
Leave the file as it is and rely on Thunderbird guessing the right ports. I
rejected it because other clients do not guess, and because a wrong published
value is worse than no value.
References
https://www.rfc-editor.org/rfc/rfc8314
https://community.nethserver.org/t/what-are-the-canonical-email-ports-settings/28783
Webtop mail mobile clients autoconfig/autodiscovery #7451