Product

TLS connection control

Over a year ago Mailgun flipped on opportunistic TLS. This means whenever we connect to an MX server, we first try and upgrade the connection to a TLS connection to deliver your messages.

This blog post was originally published in 2015. Over a year ago Mailgun flipped on opportunistic TLS. This means whenever we connect to an MX server, we first try and upgrade the connection to a TLS connection to deliver your messages. However, if it’s not offered or some kind of error occurs (like an invalid certificate) while establishing the connection, we still deliver the message, but over a plaintext SMTP connection.

Since then we’ve had customers request we expose more functionality and information for message delivery. That’s why we are releasing a few delivery related features today:

  • Force message delivery to only occur over a TLS connection.

  • Enable or disable certificate verification.

  • Expose the MX server we delivered the message to in our Logs.

  • Expose the TLS state of the connection in our Logs.

table of content

Overview

For message delivery, we will expose two new flags that will work at the domain level or message level (message level will override domain level) that allow you to control how messages are delivered:

  • require tls: If set to True this requires the message only be sent over a TLS connection. If a TLS connection can not be established, Mailgun will not deliver the message. If set to False, we will still try and upgrade the connection, but if we can not, we will downgrade and deliver over a plaintext SMTP connection. The default is False.

  • skip verification: If set to True, the certificate and hostname will not be verified when trying to establish a TLS connection and Mailgun will accept any certificate during delivery. If set to False, Mailgun will verify the certificate and if it can not, a TLS connection will not be established. The default is False.

Details on how the message was delivered will be exposed in our Logs, look for a few additional flags under the delivery-status document:

  • tls: This indicates if a TLS connection was used or not when delivering the message.

  • certificate-verified: This indicates if we verified the certificate or not when delivering the message.

  • mx-host: This will tell you the MX server we connected to to deliver the message.

Examples

If you have a single message you would like to deliver with custom connection settings, you can send it like so:

0

If you would like to configure an entire sending domain to deliver messages in a particular manner:

0

Check that your configuration was correct:

0

Lastly, if you take a look at your Mailgun Logs, you should see the delivery-status document has the new fields mentioned above.

0

Check out our documentation here, or sign up for free below:

Sign Up

It's easy to get started. And it's free.

See what you can accomplish with the world’s best email delivery platform.

Related readings

How to use parallel programming

If you’re unfamiliar with the concept of parallel programming, it probably sounds like...

Read more

How we built a Lucene-inspired parser in Go

At Mailgun we have numerous systems generating a ton of events every hour of the day. It’s...

Read more

Gubernator: Cloud-native distributed rate limiting for microservices

Today, Mailgun is excited to opensource Gubernator, a high performance distributed rate-limiting microservice. What does Gubernator...

Read more

Popular posts

Mailgun iconSee what you can accomplish with the world's best email delivery platform. It's easy to get started.Let's get sending
Milgun-Icon