Email Security Measurement Research

Virginia Tech, Department of Computer Science

What is this?

This server (email-probes.cs.vt.edu / 128.173.237.165) is part of an academic research project at Virginia Tech that measures the deployment of email transport security mechanisms across the Internet, including:

• STARTTLS — Opportunistic TLS encryption for SMTP (RFC 3207)
• DANE — DNS-Based Authentication of Named Entities (RFC 6698)
• DNSSEC — DNS Security Extensions for TLSA record validation

What do we collect?

Our scanner connects to publicly listed SMTP mail servers (MX records) on port 25 and performs a standard STARTTLS handshake. We collect:

• TLS version and cipher suite negotiated
• Server certificate chain (publicly available information)
• SMTP EHLO extension advertisements
• TLSA DNS records and DNSSEC validation status

We do NOT:

• Send any email messages
• Attempt to relay mail
• Collect any private or user data
• Exploit any vulnerabilities
• Perform any actions beyond the standard SMTP EHLO/STARTTLS handshake

Why?

This research aims to understand the current state of email transport security deployment and help improve the security of email communication worldwide. Our findings are published in peer-reviewed academic venues to benefit the Internet security community.