EmailTCP 25 Cleartext by default
Port 25: SMTP
Simple Mail Transfer Protocol
Server-to-server email relay. Encryption is opportunistic via STARTTLS, so a downgrade can leave messages in clear text.
Secure alternative: Submission on 587 with STARTTLS, or 465 with implicit TLS
How attackers abuse it
- Open relays abused to send spam and phishing.
- Spoofed sender addresses where SPF, DKIM and DMARC are missing.
- STARTTLS stripping by an attacker in the path.
How to defend it
- Never run an open relay; require authentication for submission.
- Publish SPF, DKIM and an enforcing DMARC policy.
- Consider MTA-STS to require TLS between mail servers.
Exam tip
25 is relay between servers; 587 (and 465) is client submission. SPF, DKIM and DMARC fight spoofing, not interception.