Mail servers (MX)

Mail between servers is one of the biggest blind spots in the post-quantum migration. It’s a long-lived hop that Cloudflare doesn’t carry, and a message recorded today stays readable to whoever can decrypt it later. Flarebox takes the zone’s MX records, finds the servers that receive its mail, and runs pqdoctor’s SMTP STARTTLS check on each, in the zone’s Post-quantum tab.

Post-quantum → Mail servers (MX): a self-hosted Postfix server that isn't post-quantum, with its history, and a backup MX on a private address that isn't checked · Demo mode, sample data

How it works

1. Read the MX records with the read token (Zone → DNS → Read). Hosts are sorted by priority; a host used by several records appears once, at its best priority. A null MX (0 ., RFC 7505) is told apart from no MX at all: “Explicitly no mail” versus “This zone doesn’t receive mail”.
2. Label each host by its name alone: Cloudflare Email Routing (*.mx.cloudflare.net), a known provider (Google Workspace, Microsoft 365, Proton, Fastmail, Zoho, iCloud, Amazon SES, Mimecast, Proofpoint and others), or self-hosted. Private, reserved and documentation addresses are never checked, and the reason is shown.
3. Check on a click only. Check N mail servers goes one host at a time, 1.5 seconds apart, over SMTP STARTTLS on port 25: the port other mail servers use to deliver. Only the zone’s own MX hosts can be checked, and only on port 25 or 587. Mail servers are never part of the daily re-check.
4. Read the result like an origin’s: verdict, negotiated group, cause, last checked, a sparkline, and the full report with an openssl s_client -starttls smtp command. A server that offers no STARTTLS at all is reported as “mail to it travels in plaintext”.

Port 25 is often blocked

Many home and ISP networks block outbound port 25. When the connection on port 25 times out, is refused or is reset, Flarebox says most likely your network, not the server. It never shows that as the server’s verdict and never keeps it in the history. Try 587 retries on the submission port, labelled as a different service on the same host that may not have the same TLS setup, and keeps it under its own history key. For a real answer on port 25, check from a network that allows it.

Fixes

• Self-hosted servers get pqdoctor’s stack-specific mail fixes (Postfix, Exim, Exchange, Dovecot, recognised from the SMTP greeting), without the Tunnel fix: a tunnel doesn’t carry inbound mail from other servers.
• Provider-run servers (Email Routing, Google, Microsoft and others) get one fix: “Run by provider: not yours to change”, with advice to ask the provider, and no configuration snippet.

History, alerts and reports

Results are kept like origins, under smtp://host:25 (and :587), so mail servers get the change notes, Fix applied… with a before/after fix report, the regression alert (“MX host is no longer post-quantum”) and a place in the zone’s CBOM. A host shared by several zones has one shared history. The zone’s 30-day trend counts origins only.

The Safety tab shows one line per zone from the last checks, such as “1 of 3 mail servers isn’t post-quantum”, with a button to the Post-quantum tab. Nothing is checked to build it.

Verified

The end-to-end test runs real SMTP STARTTLS against a lab server, from classical to fixed, plus the blocked-port-25 case. One real check of Cloudflare Email Routing’s route1.mx.cloudflare.net from a home network got exactly the blocked-port answer. Not yet: a real verdict for an MX host, which needs a network with port 25 open.