TLS Support
Summary: This article explains the support for Transport Layer Security (TLS) provided by DuoCircle to encrypt email transmissions, ensuring secure communication. It also includes a guide to enabling TLS for your account.
Objective
By the end of this article, you will understand how TLS encrypts emails, validate TLS settings, and enable TLS on your DuoCircle account for secure email transmissions.
Introduction
Transport Layer Security (TLS) is a protocol that encrypts email transmissions, protecting communication privacy. DuoCircle offers TLS encryption for both inbound and outbound emails, ensuring that sensitive information remains secure during transfer.
Prerequisites
- Access to your DuoCircle account.
- Permissions to manage product settings within your account.
Step-by-Step Instructions
Understanding TLS Support:
- DuoCircle supports TLS for inbound and outbound email traffic.
- In some cases, TLS must be enabled on a per-domain basis in your account settings.
- We support end-to-end TLS: internet → DuoCircle → your mail server.
Our server certificates:
Our inbound servers (for example mx1.mailhop.org) and our outbound server (outbound.mailhop.org) present publicly trusted certificates from Let's Encrypt. The certificate covers the server hostname, so a sending system can verify the hostname. The chain ends at the root certificate ISRG Root X1, which current operating systems trust.
The certificate changes about every 60 days. A system that pins the certificate or its fingerprint fails at each renewal. If a system must restrict the issuer, trust ISRG Root X1.
To test our inbound servers, enter an address at your domain, for example postmaster@yourdomain.com, in the TestReceiver test at CheckTLS.com. The result must show that the certificate is valid and that the hostname is verified.
If a system shows a certificate error when it sends mail through us, see TLS Certificate Validation Failure Error.
Enabling TLS on your account:
- Log in to your account, select the service and under the Manage Product settings click on the TLS Mode. Our suggestion is to set it to enabled, however by default for accounts created prior to January 2016 the settings is disabled. We suggest you update this to enhance your email privacy.
All other modules, including phishing protection will continue to work seamlessly.
- Log in to your account, select the service and under the Manage Product settings click on the TLS Mode. Our suggestion is to set it to enabled, however by default for accounts created prior to January 2016 the settings is disabled. We suggest you update this to enhance your email privacy.